CVE-2019-10802: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2019-10802 affects giting package versions prior to 0.0.8. This command injection vulnerability was discovered and disclosed on February 28, 2020. The vulnerability exists in the giting package, which is a Git server implementation (NVD, Snyk).

The vulnerability allows execution of arbitrary commands through the first argument 'repo' of the pull() function, which is executed by the package without any validation. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a critical severity level with network attack vector, low attack complexity, and no privileges or user interaction required (NVD).

The successful exploitation of this vulnerability could result in total loss of confidentiality, with attackers potentially gaining access to execute arbitrary commands on the affected system. The vulnerability allows attackers to execute malicious commands through the unvalidated repo parameter (Snyk).

The vulnerability is highly exploitable with proof-of-concept code available. A proof of concept demonstrates that an attacker can inject malicious commands through the repo parameter of the pull() function. The exploit has a 0.41% (75th percentile) probability of being exploited in the wild according to the EPSS model (Snyk).

The recommended mitigation is to upgrade giting to version 0.0.8 or higher, which contains the fix for this vulnerability (Snyk).