-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description states that an attacker can format a Git URL to inject additional Git arguments. The provided commit 268c11cae8cf0d9374783e06572679796abe9ce9 patches this by adding "--" before the URL argument in git commands. This "--" argument tells git to treat all subsequent arguments as positional arguments (like filenames or URLs) and not as options, even if they start with a dash. The functions clone and findRemoteDefaultBranch in get_git.go were modified in this way. Therefore, these functions were previously vulnerable to argument injection because they passed user-controlled URLs directly to git commands without this safeguard.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/go-getter | go | >= 1.5.9, < 1.7.4 | 1.7.4 |
Ongoing coverage of React2Shell