-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how user-provided 'args' are handled. The PoC demonstrates that arguments like '--upload-pack' can be injected through the options object. The git-clone implementation directly appends these arguments to the git command line (before the '--' separator), enabling command injection. The commit adds a warning about the 'args' option but doesn't fix the code. The functions responsible for processing the 'args' parameter (clone entrypoint in impl.js and argument builder in util.js) are the vulnerable points due to lack of input validation/sanitization.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| git-clone | npm | <= 0.2.0 |
Ongoing coverage of React2Shell