PT-2021-15435 · Npm · @Graphql-Tools/Git-Loader

Dotan Simha + 1 · Published 2021-01-20 · Updated 2022-05-27 · CVE-2021-23326

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions @graphql-tools/git-loader versions prior to 6.2.6

Description The issue allows for arbitrary command injection due to the use of exec and execSync in the load-git.ts file. This is a result of the package's design, which enables an attacker to inject malicious commands.

Recommendations For versions prior to 6.2.6, update to version 6.2.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the load-git.ts file or disabling the use of exec and execSync functions until a patch is applied.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2021-23326

GHSA-VHHW-XJVF-WPRR

SNYK-JS-GRAPHQLTOOLSGITLOADER-1062543

Affected Products

@Graphql-Tools/Git-Loader

References · 11

• https://github.com/ardatan/graphql-tools/commit/6a966beee8ca8b2f4adfe93318b96e4a5c501eac · Patch
• https://github.com/ardatan/graphql-tools/pull/2470 · Patch
• https://osv.dev/vulnerability/GHSA-vhhw-xjvf-wprr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23326 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23326 · Vendor Advisory
• https://github.com/ardatan/graphql-tools/releases/tag/%40graphql-tools%2Fgit-loader%406.2.6 · Note
• https://t.me/cibsecurity/22330 · Telegram Post
• https://t.me/cvenotify/30858 · Telegram Post
• https://snyk.io/vuln/SNYK-JS-GRAPHQLTOOLSGITLOADER-1062543 · Note
• https://advisory.checkmarx.net/advisory/CX-2020-4300 · Note
• https://t.me/cvenotify/8894 · Telegram Post