GHSA-gm9x-q798-hmr4: 
JavaScript vulnerability analysis and mitigation

A Command Injection vulnerability was discovered in the git-tags-remote npm package, identified as GHSA-gm9x-q798-hmr4. The vulnerability affects all versions prior to 1.0.4 and was published to the GitHub Advisory Database on July 29, 2020. The package failed to properly sanitize repository input in the get function, potentially allowing attackers to execute arbitrary code (GitHub Advisory).

The vulnerability stems from improper input sanitization where the repository input is passed directly to an exec call in the get function. The severity is rated as High with a CVSS score of 7.2. The vulnerability is classified as CWE-78 (Command Injection). The CVSS metrics indicate Network attack vector, Low attack complexity, High privileges required, and No user interaction needed, with High impact on Confidentiality, Integrity, and Availability (GitHub Advisory).

If exploited, this vulnerability could allow attackers to execute arbitrary code in the system when the repo value passed to the function is user-controlled. A proof-of-concept demonstrated the ability to create unauthorized files in the /tmp directory, indicating potential for more severe system compromise (GitHub Advisory).

The vulnerability can be exploited by passing malicious input to the get function. A proof-of-concept exploit was demonstrated using the command: gitTagsRemote.get('https://github.com/sh0ji/git-tags-remote.git; echo "Injection Success" > /tmp/command-injection.test') (GitHub Advisory).

The vulnerability has been patched in version 1.0.4 of git-tags-remote. The fix involves replacing the vulnerable exec call with spawn for more secure input handling (Git Commit).

The vulnerability was reported through npm's security advisory system and was flagged as a critical vulnerability. Users raised concerns through GitHub issues seeking fixes for the vulnerability (GitHub Issue).