CVE-2019-10776 OS command injection in git-diff-apply
Attackers can execute arbitrary commands via the remoteUrl variable in the git-diff-apply npm library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10776?
CVE-2019-10776 is a critical command injection vulnerability in git-diff-apply, published on 7 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2.
Weakness: CWE-78
Which versions are affected by CVE-2019-10776?
2 open source packages ship an affected version, including git-diff-apply. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
git-diff-apply npm | All versions | 0.22.2 |
git-diff-apply npm | All versions | 0.22.2 |
Products include Git-Diff-Apply Project Git-Diff-Apply.
How do I fix CVE-2019-10776?
Upgrade git-diff-apply to 0.22.2 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-10776 being exploited?
There is no known exploitation of CVE-2019-10776 in the wild and no public exploit code.
Sources
Also known as GHSA-84cm-v6jp-gjmr.