VYPR
← All advisories
Critical severityNVD Advisory· Published Jan 7, 2020· Updated Aug 4, 2024

CVE-2019-10776

CVE-2019-10776

Description

Command injection in git-diff-apply prior to 0.22.2 allows arbitrary command execution via a crafted remoteUrl.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Command injection in git-diff-apply prior to 0.22.2 allows arbitrary command execution via a crafted remoteUrl.

The vulnerability exists in the git-diff-apply npm package, specifically in the index.js file at line 240. The run command executes a git clone operation by constructing a command string that includes a user-controlled variable called remoteUrl. This constitutes a classic command injection flaw, as the remoteUrl is passed directly into a shell command without proper sanitization or escaping [1][2].

An attacker can exploit this by providing a specially crafted remoteUrl string containing shell metacharacters, such as & or ;, to inject arbitrary commands. The proof-of-concept (PoC) provided by JHU System Security Lab demonstrates injection with "&touch Song&", which would cause the touch command to execute on the system [2]. The attack does not require authentication if the application accepts user-supplied remote URLs.

Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the Node.js process. This could lead to full system compromise, data exfiltration, or further lateral movement within the environment. The impact is critical because git-diff-apply is often used in development or CI/CD pipelines where elevated privileges may be available.

A fix has been implemented in version 0.22.2. The patch replaces the vulnerable utils.run (which uses a shell) with runWithSpawn, which passes arguments as an array to spawn, thereby avoiding shell interpretation of the remoteUrl [3]. All users are strongly advised to upgrade to version 0.22.2 or later. No workarounds are documented, and the vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing.

References
  1. NVD - CVE-2019-10776
  2. Snyk Vulnerability Database | Snyk
  3. spawn git clone · kellyselden/git-diff-apply@106d61d

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
git-diff-applynpm
< 0.22.20.22.2

Affected products

2

Patches

1
106d61d3ae72

spawn git clone

https://github.com/kellyselden/git-diff-applyKelly SeldenJan 6, 2020via ghsa
commit
1 file changed · +2 −1
  • src/index.js+2 −1 modified
    @@ -18,6 +18,7 @@ const resolveConflicts = require('./resolve-conflicts');
 const commitAndTag = require('./commit-and-tag');
 const gitRemoveAll = require('./git-remove-all');
 const createCustomRemote = require('./create-custom-remote');
+const { runWithSpawn } = require('./run');
 
 const { isGitClean } = gitStatus;
 const { gitConfigInit } = gitInit;
@@ -222,7 +223,7 @@ module.exports = async function gitDiffApply({
     _tmpDir = await tmpDir();
     tmpWorkingDir = _tmpDir;
 
-    await utils.run(`git clone ${remoteUrl} ${_tmpDir}`);
+    await runWithSpawn('git', ['clone', remoteUrl, _tmpDir]);
 
     // needed because we are going to be committing in here
     await gitConfigInit({ cwd: _tmpDir });

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.