PT-2019-8040 · Fs · Fs-Git

Published 2019-05-29 · Updated 2019-05-29 · CVE-2017-16087

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions fs-git versions prior to 1.0.2

Description The issue arises from the lack of sanitization of strings passed into the buildCommand method, leading to arbitrary code execution.

Recommendations Update to version 1.0.2 or later.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2017-16087

GHSA-QR32-J4J6-3M7R

Affected Products

Fs-Git

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-16087 · Security Note
• https://osv.dev/vulnerability/GHSA-qr32-j4j6-3m7r · Vendor Advisory
• https://github.com/vvakame/fs-git/commit/eb5f70efa5cfbff1ab299fa7daaa5de549243998 · Note
• https://github.com/vvakame/fs-git/commit/eb5f70efa5cfbff1ab299fa7daaa5de549243998#diff-13b5b151431c7e7a17f273559ed212d5 · Note
• https://npmjs.com/advisories/360 · Note