CVE-2020-7630: 
JavaScript vulnerability analysis and mitigation

git-add-remote through version 1.0.0 contains a Command Injection vulnerability (CVE-2020-7630). The package allows execution of arbitrary commands via the name argument in its API for adding git remotes. This vulnerability was disclosed on April 2, 2020 (NVD, Snyk).

The vulnerability exists in the package's implementation where the name argument passed to the addRemote function is directly concatenated into a git command without proper sanitization. The vulnerable code is located in index.js where the command is constructed as 'git remote add ' + name + ' ' + url (GitHub). The vulnerability has a CVSS base score of 7.5 according to NVD, while Snyk rates it at 5.9 (medium severity) (Snyk).

A successful exploitation of this vulnerability could allow attackers to execute arbitrary commands on the system where the package is being used. The impact is rated as high for confidentiality, with potential for total loss of confidentiality within the impacted component (Snyk).

There is no fixed version available for git-add-remote. Users are advised to find alternative packages or implement proper input validation before passing arguments to the package (Snyk).