-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fs-git | npm | < 1.0.2 | 1.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from _buildCommand's unsafe string concatenation pattern. The commit diff shows it originally returned a raw string git --git-dir=... with joined arguments, which was then passed to child_process.exec (a known risky pattern). This method lacked input sanitization, allowing attackers to inject commands via parameters. All methods like showRef/readFile that used _buildCommand's output with exec were vulnerable, but _buildCommand itself is the root cause as the unsafe command constructor.