pullit vulnerable to command injection

CRITICO 9.8CVE-2018-25083 · GHSA-8px5-63x9-5c7p · Published 27/03/2023 · updated 17/06/2026

In breve

CVE-2018-25083 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda pull it (pull it project), pullit.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.7%, superiore al 86.0% delle vulnerabilità.
Correzione: aggiornare a 1.4.0 o successiva.

Package	Affected versions	Patched versions
pull it pull_it_project	`< 1.4.0`	`1.4.0`
pullit npm	`< 1.4.0`	`1.4.0`

Description

Versions of pullit prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.

Recommendation

Upgrade to version 1.4.0 or later.

Credits

This vulnerability was discovered by @lirantal

NVD description

The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.

References

nvd.nist.gov/vuln/detail/CVE-2018-25083 · ADVISORY
jkup/pullit · WEB
jkup/pullit commit 4fec455 · WEB
hackerone.com/reports/315773 · WEB
jkup/pullit · PACKAGE
security.snyk.io/vuln/npm:pullit:20180214 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free