CVE-2022-24437

The package git-pull-or-clone before 2.0.2 is vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection. ## Credits Credit @lirantal for discovering this vulnerability.

The package git-pull-or-clone before 2.0.2 is vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection. ## Credits Credit @lirantal for discovering this vulnerability.

El paquete git-pull-or-clone versiones anteriores a 2.0.2, es vulnerable a una inyección de comandos debido al uso de la función --upload-pack de git, que también es compatible con git clone. La fuente incluye el uso de la API spawn() del proceso hijo seguro. Sin embargo, el parámetro outpath que le es pasado puede ser un argumento de la línea de comandos del comando git clone y resultar en una inyección arbitraria de comandos