GHSA-chj3-f7xw-367mHighCVSS 7.2

OS Command Injection in git-promise

Published
June 11, 2022
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2022-24376 →

📋 Description

All versions of package git-promise is vulnerable to Command Injection due to an inappropriate fix of a prior vulnerability in this package. Note: Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue.

Credits

@lirantal for discovering this vulnerability.

🎯 Affected products1

  • npm/git-promise:<= 1.0.0

🔗 References (5)