CVE-2021-3190: 
JavaScript vulnerability analysis and mitigation

The async-git package before version 1.13.2 for Node.js contains a vulnerability (CVE-2021-3190) that allows OS Command Injection via shell metacharacters, specifically affecting the git.reset and git.tag functions. The vulnerability was discovered and disclosed in January 2021 (NVD).

The vulnerability stems from improper neutralization of special elements used in OS commands, classified as CWE-78. The issue allows attackers to inject shell metacharacters through the git.reset and git.tag functions. The vulnerability has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

If exploited, this vulnerability could allow an attacker to execute arbitrary OS commands through shell metacharacters when using the affected git.reset and git.tag functions. This could potentially lead to unauthorized command execution on the system running the vulnerable package (Checkmarx Advisory).

The vulnerability can be exploited by passing shell metacharacters to the git.reset and git.tag functions. Tests demonstrating the vulnerability show that commands like '; touch HACKED #' could be used to execute arbitrary commands (GitHub PR).

The vulnerability was patched in version 1.13.2 of the async-git package. The fix involved sanitizing user input by using JSON.stringify for command arguments and later switching to spawn with git to avoid shell script vulnerabilities entirely (GitHub PR, GitHub PR).