CVE-2022-25648: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

April 19, 2022 (updated November 7, 2023)

The package git before 1.11.0 is vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

References

github.com/ruby-git/ruby-git/pull/569
github.com/ruby-git/ruby-git/releases/tag/v1.11.0
nvd.nist.gov/vuln/detail/CVE-2022-25648
snyk.io/vuln/SNYK-RUBY-GIT-2421270

Code Behaviors & Features

Detect and mitigate CVE-2022-25648 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →