GHSA-7xcx-6wjh-7xp2: 
JavaScript vulnerability analysis and mitigation

A command injection vulnerability was discovered in the standardVersion function of the standard-version npm package (GHSA-7xcx-6wjh-7xp2). The vulnerability was identified and reported by GitHub Engineer Erik Krogh Kristensen on May 19, 2020, and was publicly disclosed on July 12, 2020. The vulnerability affects versions prior to 8.0.1 of the standard-version package (GitHub Advisory).

The vulnerability allows for command injection through the standardVersion function. The issue occurs when the function processes untrusted input, particularly in the releaseCommitMessageFormat parameter. A proof-of-concept demonstrates that an attacker can execute arbitrary commands by injecting shell commands through backticks in the releaseCommitMessageFormat option. This vulnerability is similar to command injection vulnerabilities found in other JavaScript libraries (Security Lab).

The vulnerability may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This could potentially allow attackers to execute arbitrary commands on the affected system (GitHub Advisory).

A proof-of-concept exploit exists that demonstrates how an attacker can create arbitrary files on the system by injecting commands through the releaseCommitMessageFormat parameter. The vulnerability can be triggered by creating a specific configuration that includes malicious shell commands in backticks (Security Lab).

The vulnerability has been fixed in version 8.0.1 of standard-version. The recommended remediation is to update to this version or later. For those unable to update immediately, it is recommended to avoid using APIs that can interpret strings as shell commands. The developers suggest using child_process.execFile instead of child_process.exec (GitHub Advisory).