CVE-2020-28490: 
JavaScript vulnerability analysis and mitigation

The async-git package versions before 1.13.2 contain a Command Injection vulnerability (CVE-2020-28490). This vulnerability was discovered in January 2021 and affects the package's git command execution functionality. The vulnerability allows attackers to inject malicious commands through shell meta-characters, specifically using back-ticks (Snyk).

The vulnerability exists in the command execution mechanism where the package fails to properly sanitize input when executing git commands. An example of exploitation includes using back-ticks in commands like git.reset('atouch HACKEDb'). The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) by NVD and 9.1 (CRITICAL) by Snyk, indicating its severe nature. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command) (NVD, Snyk).

The vulnerability can lead to complete system compromise through command injection. According to the CVSS metrics, successful exploitation could result in total loss of confidentiality and integrity, allowing attackers to execute arbitrary commands with the privileges of the application running the async-git package (Snyk).

The vulnerability is easily exploitable with network access and requires no special privileges or user interaction. The attack complexity is rated as low, indicating that an attacker can expect repeatable success when exploiting the vulnerable component (Snyk).

The vulnerability has been fixed in version 1.13.2 of the async-git package. The fix involves using spawn with git to avoid shell script vulnerabilities. Users should upgrade to version 1.13.2 or higher to mitigate this vulnerability (GitHub Commit).