CVE-2018-25083 pullit vulnerable to command injection
Attackers can execute arbitrary OS commands via eval on Git branch names in the pullit Node.js package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-25083?
CVE-2018-25083 is a critical command injection vulnerability in n/a, published on 27 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.
Weakness: CWE-78
Which versions are affected by CVE-2018-25083?
2 open source packages ship an affected version, including pullit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pullit npm | All versions | 1.4.0 |
pullit npm | All versions | 1.4.0 |
Products include Pull It Project Pull It.
How do I fix CVE-2018-25083?
Upgrade pullit to 1.4.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-25083 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-25083 exists.
Sources
Also known as GHSA-8px5-63x9-5c7p.