CVE-2022-1440: Command injection in git-interface

April 22, 2022 (updated May 4, 2022)

Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a --upload-pack command-line argument feature of git is also supported for git clone, which would then allow for any operating system command to be spawned by the attacker.

References

github.com/advisories/GHSA-qffw-8wg7-h665
github.com/yarkeev/git-interface/commit/f828aa790016fee3aa667f7b44cf94bf0aa8c60d
huntr.dev/bounties/cdc25408-d3c1-4a9d-bb45-33b12a715ca1
nvd.nist.gov/vuln/detail/CVE-2022-1440

Code Behaviors & Features

Detect and mitigate CVE-2022-1440 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →