Headline
CVE-2023-26134: Fix: validate commit hashes before executing them | closes #24 · JPeer264/node-git-commit-info@f7c491e
Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they control the hash content.
Expand Up
@@ -20,6 +20,7 @@ export interface GitCommitInfoResult {
}
const regex = /\s+([\s\S]*)/g; // matches everything after the first whitespace
const hashRegex = /^[0-9a-f]{7,40}$/;
const gitCommitInfo = (options: GitCommitInfoOptions = {}): GitCommitInfoResult => {
const {
Expand All
@@ -29,6 +30,10 @@ const gitCommitInfo = (options: GitCommitInfoOptions = {}): GitCommitInfoResult
const thisCommit = commit || '’;
const thisPath = path.resolve(cwd);
if ((thisCommit && !(new RegExp(hashRegex).test(thisCommit)))) {
return { error: new Error(‘Not a valid commit hash’) };
}
if (!isGit(thisPath)) {
return {};
}
Expand Down
Related news
Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo() fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they control the hash content.