PT-2022-14942 · Masterminds · Vcs

Alessio Della Libera · Published 2022-04-01 · Updated 2026-03-17 · CVE-2022-21235

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions github.com/masterminds/vcs versions prior to 1.13.3

Description The issue concerns command injection via argument injection. When hg is executed, argument strings are passed in a way that allows additional flags to be set, which can be used for command injection. This can occur when URLs and local file paths passed to the Mercurial (hg) APIs are specially crafted to contain commands. The vcs package uses the underlying version control system, in this case hg, and other version control systems with an implemented interface may also be vulnerable. Passing untrusted inputs to VCS functions can permit an attacker to execute arbitrary commands.

Recommendations For versions prior to 1.13.3, update to version 1.13.3 or later to resolve the issue. As a temporary workaround, consider sanitizing data passed to the vcs package APIs to ensure it does not contain commands or unexpected data, especially for user input data that is passed directly to the package APIs.

Fix

Argument Injection

Command Injection

Weakness Enumeration

CWE-88

CWE-77

Related Identifiers

CVE-2022-21235

GHSA-6635-C626-VJ4R

GO-2022-0414

SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078

Affected Products

Vcs

References · 13

• https://github.com/Masterminds/vcs/pull/105 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-21235 · Security Note
• https://osv.dev/vulnerability/GHSA-6635-c626-vj4r · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0414 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21235 · Vendor Advisory
• https://github.com/Masterminds/vcs/security/advisories/GHSA-6635-c626-vj4r · Note
• https://github.com/Masterminds/vcs/commit/922a5122330ea8fbe56352a0172ddb6bf019cd22 · Note
• https://github.com/Masterminds/vcs · Note
• https://github.com/Masterminds/vcs/releases/tag/v1.13.2 · Note
• https://twitter.com/pulsepatchio/status/2033921297223172433 · Twitter Post
• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078 · Note
• https://t.me/cibsecurity/40009 · Telegram Post
• https://t.me/cvenotify/28284 · Telegram Post