PT-2024-18946 · Ggit · Ggit

Liran Tal · Published 2024-10-07 · Updated 2026-03-27 · CVE-2024-21532

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ggit versions all

Description The issue concerns Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched. This input is then concatenated with a git command and passed to the unsafe exec() Node.js child process API.

Recommendations For all versions, consider disabling the fetchTags(branch) API until a patch is available to prevent exploitation. Restrict access to the exec() function to minimize the risk of Command Injection. Avoid using user-inputted data in the branch variable to prevent malicious commands from being executed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-21532

GHSA-62CX-5XJ4-WFM4

Affected Products

Ggit

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-21532 · Security Note
• https://osv.dev/vulnerability/GHSA-62cx-5xj4-wfm4 · Vendor Advisory
• https://github.com/bahmutov/ggit · Note
• https://github.com/bahmutov/ggit/blob/2e85b0316d9c272e067dca5679d39e302f4cb9cd/README.md?plain=1#L3 · Note
• https://twitter.com/integ_sec/status/2037550357052625091 · Twitter Post
• https://t.me/cvedetector/7314 · Telegram Post
• https://twitter.com/CVEnew/status/1843525247988887774 · Twitter Post
• https://gist.github.com/lirantal/d8f87b366d2078e6118ab7bf2b005f02 · Note
• https://t.me/cvenotify/97378 · Telegram Post
• https://twitter.com/cracbot/status/1845343773213196482 · Twitter Post
• https://security.snyk.io/vuln/SNYK-JS-GGIT-5731320 · Note