CVE-2021-44685 Command injection in git-it-electron
Git-it allows OS command injection via unsanitized branch names during verification, enabling arbitrary code execution for users completing specific challenges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-44685?
CVE-2021-44685 is a critical command injection vulnerability in n/a, published on 6 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).
Weakness: CWE-78
Which versions are affected by CVE-2021-44685?
2 open source packages ship an affected version, including git-it-electron. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
git-it-electron npm | All versions to 4.3.0 | None |
git-it-electron npm | All versions to 4.3.0 | None |
Products include Git-It Project Git-It.
How do I fix CVE-2021-44685?
No fix has been published for CVE-2021-44685 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-44685 being exploited?
There is no known exploitation of CVE-2021-44685 in the wild and no public exploit code.
Sources
Also known as GHSA-wjqc-j537-j9gj.