`git-comiters` Command Injection vulnerability

Root

Cause

The git-commiters npm package up to version 0.1.1 contains a command injection vulnerability in its primary API, gitCommiters(options, callback). The options.revisionRange parameter is directly concatenated into a shell command without proper sanitization or use of a secure process execution API that separates commands from arguments [1][2]. This allows an attacker to inject arbitrary shell commands when the library constructs and executes a git command using child_process or similar functions.

Exploitation

The vulnerability can be exploited by providing a malicious revisionRange value. For example, setting revisionRange: "HEAD; touch /tmp/pwn; #" will cause the library to execute git with the injected command touch /tmp/pwn, creating a file on the filesystem [2]. No authentication or special privileges are required beyond the ability to control the options object passed to gitCommiters(). The library's normal operation continues, making the injection potentially stealthy [2].

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the system running the vulnerable package, with the same privileges as the Node.js process [1][2]. This can lead to full system compromise, data exfiltration, or further lateral movement, depending on the environment.

Remediation

The issue has been patched in version 0.1.2 by sanitizing the revisionRange input—removing single and double quotes and wrapping the value in quotes—to prevent injection [4]. Users are strongly advised to update to version 0.1.2 or later [1][2].