CVE-2022-1440 Command Injection vulnerability in [email protected] in yarkeev/git-interface
An attacker can execute arbitrary OS commands via the --upload-pack argument in git clone operations within the git-interface library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-1440?
CVE-2022-1440 is a critical command injection vulnerability in yarkeev/git-interface, published on 22 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Command Injection vulnerability in [email protected] in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.
Weakness: CWE-78
Which versions are affected by CVE-2022-1440?
2 open source packages ship an affected version, including git-interface. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
git-interface npm | All versions | 2.1.2 |
git-interface npm | All versions | 2.1.2 |
Products include Git-Interface Project Git-Interface.
How do I fix CVE-2022-1440?
Upgrade git-interface to 2.1.2 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-1440 being exploited?
There is no known exploitation of CVE-2022-1440 in the wild and no public exploit code.
Sources
Also known as GHSA-qffw-8wg7-h665.