Command Injection in async-git

CRÍTICO 9.8CVE-2020-28490 · GHSA-6qpr-9mc5-7gch · SNYK-JS-ASYNCGIT-1064877 · Published 18/02/2021 · updated 17/06/2026

En resumen

CVE-2020-28490 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a async-git (async-git project), async-git.
Probabilidad de explotación en los próximos 30 días (EPSS): 2.5%, mayor que el 85.1% de las vulnerabilidades.
Solución: actualizar a 1.13.2 o posterior.

Package	Affected versions	Patched versions
async-git async-git_project	`< 1.13.2`	`1.13.2`
async-git npm	`< 1.13.2`	`1.13.2`

Description

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb')

NVD description

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb')

References

nvd.nist.gov/vuln/detail/CVE-2020-28490 · ADVISORY
omrilotan/async-git#14 · WEB
omrilotan/async-git commit d1950a5 · WEB
snyk.io/vuln/SNYK-JS-ASYNCGIT-1064877 · WEB
npmjs.com/package/async-git · WEB

Más vulnerabilidades de async-git

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free