VYPR
← All advisories
Critical severityNVD Advisory· Published May 1, 2022· Updated Sep 16, 2024

Command Injection

CVE-2022-24437

Description

The git-pull-or-clone package before 2.0.2 is vulnerable to command injection via the --upload-pack argument in git clone.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The git-pull-or-clone package before 2.0.2 is vulnerable to command injection via the --upload-pack argument in git clone.

Vulnerability

In the git-pull-or-clone npm package versions prior to 2.0.2, a command injection vulnerability exists due to improper handling of the --upload-pack feature of git, which is also supported for git clone [1], [2]. The package uses the secure spawn() API to execute git commands, but the outPath parameter is passed as a command-line argument to git clone without proper sanitization, allowing an attacker to inject arbitrary commands [1], [2], [3].

Exploitation

An attacker who can control either the url or the outPath parameter passed to gitPullOrClone() can inject commands by providing a string that begins with --upload-pack= followed by the desired command [2], [3]. For example, setting the outPath to --upload-pack=touch /tmp/pwn3 or the url to --upload-pack=touch /tmp/pwn4 results in the execution of touch [2]. No other authentication or user interaction is required beyond the ability to call the function with attacker-controlled arguments.

Impact

Successful exploitation allows arbitrary command execution on the system where the package is used [1], [2], [3]. The attacker can execute any system command with the privileges of the Node.js process, potentially leading to full system compromise, data exfiltration, or further lateral movement.

Mitigation

The vulnerability is fixed in version 2.0.2 of git-pull-or-clone [3]. Users should upgrade to this version or later. There are no known workarounds; the only mitigation is to update the package [3].

References
  1. NVD - CVE-2022-24437
  2. Command Injection vulnerability in git-clone-or-pull@2.0.1
  3. Snyk Vulnerability Database | Snyk

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
git-pull-or-clonenpm
< 2.0.22.0.2

Affected products

2

Patches

1
f9ce092be13c

fix: fix command injection vector

https://github.com/feross/git-pull-or-cloneLiran TalApr 6, 2022via ghsa
commit
1 file changed · +1 −1
  • index.js+1 −1 modified
    @@ -28,7 +28,7 @@ function gitPullOrClone (url, outPath, opts, cb) {
   function gitClone () {
     // --depth implies --single-branch
     const flag = depth < Infinity ? '--depth=' + depth : '--single-branch'
-    const args = ['clone', flag, url, outPath]
+    const args = ['clone', flag, '--', url, outPath]
     debug('git ' + args.join(' '))
     spawn('git', args, {}, function (err) {
       if (err) err.message += ' (git clone) (' + url + ')'

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.