VYPR
← All advisories
High severityNVD Advisory· Published Jul 1, 2022· Updated Sep 17, 2024

Command Injection

CVE-2022-25900

Description

All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
git-clonenpm
<= 0.2.0—

Affected products

1

Patches

1
fd330459593a

Add security notice about args option

https://github.com/jaz303/git-cloneJason FrameMar 28, 2022via ghsa
commit
1 file changed · +3 −0
  • README.md+3 −0 modified
    @@ -25,6 +25,9 @@ As of 0.2.0 there's a promised-based API for use with `async`/`await`:
   * `checkout`: revision/branch/tag to check out after clone
   * `args`: additional array of arguments to pass to `git clone`
 
+**NOTE:** the `args` option allows arbitrary arguments to be passed to `git`; this is inherently insecure if used in
+combination with untrusted input. **Only use the `args` option with static/trusted input!**
+
 ## Callback
 
 #### `clone(repo, targetPath, [options], cb)`

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.