OS command injection in git-diff-apply

KRITISCH 9.8CVE-2019-10776 · GHSA-84cm-v6jp-gjmr · Published 07/01/2020 · updated 17/06/2026

Kurz gesagt

CVE-2019-10776 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in git-diff-apply (git-diff-apply project), git-diff-apply.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.1%, höher als bei 82.2% aller Schwachstellen.
Abhilfe: auf 0.22.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
git-diff-apply git-diff-apply_project	`< 0.22.2`	`0.22.2`
git-diff-apply npm	`< 0.22.2`	`0.22.2`

Description

In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2.

NVD description

In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2.

References

nvd.nist.gov/vuln/detail/CVE-2019-10776 · ADVISORY
kellyselden/git-diff-apply commit 106d61d · WEB
snyk.io/vuln/SNYK-JS-GITDIFFAPPLY-540774 · WEB
snyk.io/vuln/SNYK-JS-GITDIFFAPPLY-540774, · WEB
snyk.io/vuln/SNYK-JS-GITDIFFAPPLY-540774%2C

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free