-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from line 27 in index.js where user-controlled parameters are directly used in spawned git commands. The function fails to sanitize clonePath argument which gets pushed to args array (line 27) and executed via spawn('git', args). This allows attackers to inject git flags like --upload-pack through the clonePath parameter, as demonstrated in Snyk's PoC. The combination of direct user input usage in process spawning and lack of argument sanitization matches CWE-88's pattern of argument injection vulnerabilities.
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| git-shallow-clone | npm | <= 0.0.2 |
Ongoing coverage of React2Shell