-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper neutralization of special elements in git commands. The patch adds '--' argument separators and proper parameter formatting in multiple functions (Clone, LsRemote, fetchAndReset, reset), and fixes shell quoting in gitCmd. The affected functions directly process user-controlled inputs (branch names, URLs, passwords) without proper validation, enabling command/argument injection. The Go vulnerability report (GO-2023-1515) explicitly lists Clone, LsRemote and related functions as affected symbols. The commit diff shows critical security fixes in these specific functions, confirming their vulnerability to injection attacks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rancher/wrangler | go | <= 0.7.3 | 0.7.4-security1 |
| github.com/rancher/wrangler | go | >= 0.8.0, <= 0.8.4 | 0.8.5-security1 |
| github.com/rancher/wrangler | go | = 1.0.0 | 1.0.1 |
| github.com/rancher/wrangler | go | >= 0.8.6, < 0.8.11 | 0.8.11 |