-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how the Grit::Repo#grep method in lib/grit/repo.rb called git.native(:grep) without the {pipeline: false} option prior to the patch. The commit diff shows the patched version explicitly adds pipeline: false to this call. In vulnerable versions, when user input containing pipe characters (|) was passed to the code search (which uses this grep method), the native command execution would interpret the pipe as a shell operator due to missing pipeline:false. The git.native function's pipeline handling in lib/grit/git.rb only executed shell pipelines when the pipeline option was enabled, but the grep method's lack of pipeline:false in vulnerable versions left this pathway open for exploitation via malicious input.
RubyRuby| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gitlab-grit | rubygems | < 2.6.1 | 2.6.1 |