The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it was possible to get arbitrary command execution.
simple-git (maintained as git-js named repository on GitHub) is a light weight interface for running git commands in any node.js application.The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover. A fix was released in simple-git@3.6.0.
Release Notes
steveukx/git-js
### [`v3.5.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#350)
[Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.4.0...simple-git@3.5.0)
##### Minor Changes
- [`2040de6`](https://togithub.com/steveukx/git-js/commit/2040de6): Resolves potential command injection vulnerability by preventing use of `--upload-pack` in `git.clone`
### [`v3.4.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#340)
[Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.3.0...simple-git@3.4.0)
##### Minor Changes
- [`ed412ef`](https://togithub.com/steveukx/git-js/commit/ed412ef): Use null separators in git.status to allow for non-ascii file names
### [`v3.3.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#330)
[Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.2.6...simple-git@3.3.0)
##### Minor Changes
- [`d119ec4`](https://togithub.com/steveukx/git-js/commit/d119ec4): Resolves potential command injection vulnerability by preventing use of `--upload-pack` in `git.fetch`
### [`v3.2.6`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#326)
[Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.2.4...simple-git@3.2.6)
##### Patch Changes
- [`80651d5`](https://togithub.com/steveukx/git-js/commit/80651d5): Resolve issue in prePublish script
### [`v3.2.4`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#324)
[Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.1.1...simple-git@3.2.4)
##### Patch Changes
- [`d35987b`](https://togithub.com/steveukx/git-js/commit/d35987b): Release with changesets
### [`v3.1.1`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#311-httpswwwgithubcomsteveukxgit-jscomparesimple-git-v310simple-git-v311-2022-01-26)
[Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.1.0...simple-git-v3.1.1)
### [`v3.1.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#310-httpswwwgithubcomsteveukxgit-jscomparesimple-git-v304simple-git-v310-2022-01-23)
[Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.0.4...simple-git-v3.1.0)
##### Features
- optionally include ignored files in `StatusResult` ([70e6767](https://www.github.com/steveukx/git-js/commit/70e676759012d26ab644644e10f7957fba51ae2f)), closes [#718](https://www.togithub.com/steveukx/git-js/issues/718)
##### [3.0.4](https://www.github.com/steveukx/git-js/compare/simple-git-v3.0.3...simple-git-v3.0.4) (2022-01-23)
##### Bug Fixes
- support parsing empty responses ([91eb7fb](https://www.github.com/steveukx/git-js/commit/91eb7fb01fe466468537621cb94b9f932026506e)), closes [#713](https://www.togithub.com/steveukx/git-js/issues/713)
##### [3.0.3](https://www.github.com/steveukx/git-js/compare/simple-git-v3.0.2...simple-git-v3.0.3) (2022-01-20)
##### Bug Fixes
- allow branches without labels ([07a1388](https://www.github.com/steveukx/git-js/commit/07a138808fb0b78068da83030698a957e567541c))
- implement v3 deprecations ([ed6d18e](https://www.github.com/steveukx/git-js/commit/ed6d18e88a6a4f9fd18d4733a94b491e0e9e3ba1))
- publish v3 as `latest` ([5db4434](https://www.github.com/steveukx/git-js/commit/5db4434d00acba560fe2569c04f9813cde026468))
##### [3.0.2](https://www.github.com/steveukx/git-js/compare/simple-git-v3.0.1...simple-git-v3.0.2) (2022-01-18)
##### Bug Fixes
- Backward compatibility - permit loading `simple-git/promise` with deprecation notice until mid-2022. ([4413c47](https://www.github.com/steveukx/git-js/commit/4413c47fa3d9893734a5bb06075b962645f73cb9))
##### [3.0.1](https://www.github.com/steveukx/git-js/compare/simple-git-v3.0.0...simple-git-v3.0.1) (2022-01-18)
##### Bug Fixes
- Documentation update ([4e000f6](https://www.github.com/steveukx/git-js/commit/4e000f69aa876b3999ec98fe42e94186facd5790))
### [`v3.0.4`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#304-httpswwwgithubcomsteveukxgit-jscomparesimple-git-v303simple-git-v304-2022-01-23)
[Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.0.3...simple-git-v3.0.4)
### [`v3.0.3`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#303-httpswwwgithubcomsteveukxgit-jscomparesimple-git-v302simple-git-v303-2022-01-20)
[Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.0.2...simple-git-v3.0.3)
### [`v3.0.2`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#302-httpswwwgithubcomsteveukxgit-jscomparesimple-git-v301simple-git-v302-2022-01-18)
[Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.0.1...simple-git-v3.0.2)
### [`v3.0.1`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#301-httpswwwgithubcomsteveukxgit-jscomparesimple-git-v300simple-git-v301-2022-01-18)
[Compare Source](https://togithub.com/steveukx/git-js/compare/v2.48.0...simple-git-v3.0.1)
Configuration
📅 Schedule: "" (UTC).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, click this checkbox.
This PR contains the following updates:
^2.23.0->^3.0.0GitHub Vulnerability Alerts
CVE-2022-24433
The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it was possible to get arbitrary command execution.
CVE-2022-24066
simple-git(maintained as git-js named repository on GitHub) is a light weight interface for running git commands in any node.js application.The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover. A fix was released in simple-git@3.6.0.Release Notes
steveukx/git-js
### [`v3.5.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#350) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.4.0...simple-git@3.5.0) ##### Minor Changes - [`2040de6`](https://togithub.com/steveukx/git-js/commit/2040de6): Resolves potential command injection vulnerability by preventing use of `--upload-pack` in `git.clone` ### [`v3.4.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#340) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.3.0...simple-git@3.4.0) ##### Minor Changes - [`ed412ef`](https://togithub.com/steveukx/git-js/commit/ed412ef): Use null separators in git.status to allow for non-ascii file names ### [`v3.3.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#330) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.2.6...simple-git@3.3.0) ##### Minor Changes - [`d119ec4`](https://togithub.com/steveukx/git-js/commit/d119ec4): Resolves potential command injection vulnerability by preventing use of `--upload-pack` in `git.fetch` ### [`v3.2.6`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#326) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git@3.2.4...simple-git@3.2.6) ##### Patch Changes - [`80651d5`](https://togithub.com/steveukx/git-js/commit/80651d5): Resolve issue in prePublish script ### [`v3.2.4`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#324) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.1.1...simple-git@3.2.4) ##### Patch Changes - [`d35987b`](https://togithub.com/steveukx/git-js/commit/d35987b): Release with changesets ### [`v3.1.1`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#311-httpswwwgithubcomsteveukxgit-jscomparesimple-git-v310simple-git-v311-2022-01-26) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.1.0...simple-git-v3.1.1) ### [`v3.1.0`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#310-httpswwwgithubcomsteveukxgit-jscomparesimple-git-v304simple-git-v310-2022-01-23) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.0.4...simple-git-v3.1.0) ##### Features - optionally include ignored files in `StatusResult` ([70e6767](https://www.github.com/steveukx/git-js/commit/70e676759012d26ab644644e10f7957fba51ae2f)), closes [#718](https://www.togithub.com/steveukx/git-js/issues/718) ##### [3.0.4](https://www.github.com/steveukx/git-js/compare/simple-git-v3.0.3...simple-git-v3.0.4) (2022-01-23) ##### Bug Fixes - support parsing empty responses ([91eb7fb](https://www.github.com/steveukx/git-js/commit/91eb7fb01fe466468537621cb94b9f932026506e)), closes [#713](https://www.togithub.com/steveukx/git-js/issues/713) ##### [3.0.3](https://www.github.com/steveukx/git-js/compare/simple-git-v3.0.2...simple-git-v3.0.3) (2022-01-20) ##### Bug Fixes - allow branches without labels ([07a1388](https://www.github.com/steveukx/git-js/commit/07a138808fb0b78068da83030698a957e567541c)) - implement v3 deprecations ([ed6d18e](https://www.github.com/steveukx/git-js/commit/ed6d18e88a6a4f9fd18d4733a94b491e0e9e3ba1)) - publish v3 as `latest` ([5db4434](https://www.github.com/steveukx/git-js/commit/5db4434d00acba560fe2569c04f9813cde026468)) ##### [3.0.2](https://www.github.com/steveukx/git-js/compare/simple-git-v3.0.1...simple-git-v3.0.2) (2022-01-18) ##### Bug Fixes - Backward compatibility - permit loading `simple-git/promise` with deprecation notice until mid-2022. ([4413c47](https://www.github.com/steveukx/git-js/commit/4413c47fa3d9893734a5bb06075b962645f73cb9)) ##### [3.0.1](https://www.github.com/steveukx/git-js/compare/simple-git-v3.0.0...simple-git-v3.0.1) (2022-01-18) ##### Bug Fixes - Documentation update ([4e000f6](https://www.github.com/steveukx/git-js/commit/4e000f69aa876b3999ec98fe42e94186facd5790)) ### [`v3.0.4`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#304-httpswwwgithubcomsteveukxgit-jscomparesimple-git-v303simple-git-v304-2022-01-23) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.0.3...simple-git-v3.0.4) ### [`v3.0.3`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#303-httpswwwgithubcomsteveukxgit-jscomparesimple-git-v302simple-git-v303-2022-01-20) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.0.2...simple-git-v3.0.3) ### [`v3.0.2`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#302-httpswwwgithubcomsteveukxgit-jscomparesimple-git-v301simple-git-v302-2022-01-18) [Compare Source](https://togithub.com/steveukx/git-js/compare/simple-git-v3.0.1...simple-git-v3.0.2) ### [`v3.0.1`](https://togithub.com/steveukx/git-js/blob/HEAD/simple-git/CHANGELOG.md#301-httpswwwgithubcomsteveukxgit-jscomparesimple-git-v300simple-git-v301-2022-01-18) [Compare Source](https://togithub.com/steveukx/git-js/compare/v2.48.0...simple-git-v3.0.1)Configuration
📅 Schedule: "" (UTC).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by WhiteSource Renovate. View repository job log here.