CVE-2022-25865 Command Injection
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2022-25865?
CVE-2022-25865 is a high-severity vulnerability in workspace-tools, published on 13 May 2022.
Official description
The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function, both the remote and remoteBranch parameters are passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Weakness: CWE-88
Which versions are affected by CVE-2022-25865?
2 open source packages ship an affected version, including workspace-tools. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
workspace-tools npm | All versions | 0.18.4 |
workspace-tools npm | All versions | 0.18.4 |
Products include Microsoft Workspace-Tools.
How do I fix CVE-2022-25865?
Upgrade workspace-tools to 0.18.4 or later.
Is CVE-2022-25865 being exploited?
There is no known exploitation of CVE-2022-25865 in the wild and no public exploit code.
Sources
Also known as GHSA-5875-m6jq-vf78, SNYK-JS-WORKSPACETOOLS-2421201.