CVE-2020-26222: 
Ruby vulnerability analysis and mitigation

Dependabot-Core, a set of packages for automated dependency management, contained a remote code execution vulnerability (CVE-2020-26222) affecting versions from 0.119.0.beta1 to versions before 0.125.1. The vulnerability was present in dependabot-common and dependabot-go_modules components and was discovered in November 2020 (GitHub Advisory).

The vulnerability exists when a source branch name contains malicious injectable bash code. When Dependabot is configured to clone the source repository during an update, it runs a shell command to git clone the repository without properly escaping the branch name. For example, if Dependabot is configured with a branch name like '/$({curl,127.0.0.1})', it would execute the injected command during the cloning process. This affects go_modules during the file fetching step and can be triggered in other package managers using the FileFetcher class from dependabot-common (GitHub Advisory).

The vulnerability allows attackers to achieve remote code execution by crafting malicious branch names that contain injectable bash code. When exploited, attackers could execute arbitrary commands on systems running vulnerable versions of Dependabot during repository cloning operations (GitHub Advisory).

The vulnerability can be exploited by configuring Dependabot to use a maliciously crafted branch name. The exploitation requires the attacker to have control over the branch name used in the Dependabot configuration or to trick a user into using a malicious branch name (GitHub Advisory).

The vulnerability was patched in version 0.125.1. As a workaround, users can escape the branch name prior to passing it to the Dependabot::Source class using shellwords. For example: 'require "shellwords"; branch = Shellwords.escape("/$({curl,127.0.0.1})")' (GitHub Advisory, GitHub Commit).