Medium severity6.5GHSA Advisory· Published Oct 8, 2024· Updated Apr 15, 2026
CVE-2024-21533
CVE-2024-21533
Description
All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL to clone and the file on disk to clone to. The library does not sanitize for user input or validate a given URL scheme, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ggitnpm | <= 2.4.12 | — |
Affected products
2Patches
Vulnerability mechanics
References
5News mentions
0No linked articles in our index yet.