GHSA-hxwm-x553-x359: 
JavaScript vulnerability analysis and mitigation

A command injection vulnerability was discovered in npmcli/git versions prior to 2.0.8, identified as GHSA-hxwm-x553-x359. The vulnerability was reported through the GitHub Bug Bounty Program by @tyage from Ierae Security and was published on July 27, 2021. The issue affected the npm package @npmcli/git and could allow arbitrary shell command execution due to improper argument sanitization when executing Git commands with user-controlled input (GitHub Advisory).

The vulnerability stems from npmcli/git passing user-controlled input as arguments to shell commands without proper sanitization. For example, an input like git+https://github.com/npm/git; echo hello world could trigger unauthorized shell execution of the command echo hello world. The vulnerability is classified as CWE-78 (OS Command Injection) and has been assigned a Moderate severity rating (GitHub Advisory).

The vulnerability enables arbitrary command injection when npmcli/git is executed with untrusted (user-controlled) Git command arguments, potentially allowing attackers to execute unauthorized shell commands on affected systems (GitHub Advisory).

The vulnerability was patched in version 2.0.8 of npmcli/git. The fix involved removing the use of an intermediate shell for executing Git commands, as implemented in PR #29. Users should upgrade to version 2.0.8 or later to address this security issue (GitHub PR, GitHub Advisory).