-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation when processing branch names containing single quotes. The patch in PR#62 added --python flag to git for-each-ref to get properly escaped output, indicating the original implementation lacked this safety measure. The get_refs function would have parsed unescaped branch names using eval() or similar methods, creating an injection vector. This matches CWE-20 (Improper Input Validation) and explains the code execution vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| git-big-picture | pip | < 1.0.0 | 1.0.0 |