Lucene search
GoogleOSV:GHSA-8PX5-63X9-5C7PHistorySep 03, 2020 - 4:47 p.m.
pullit vulnerable to command injection
2020-09-0316:47:30
Google
osv.dev
7
pullit
command injection
version 1.4.0
vulnerable
input validation
git branch
arbitrary commands
system
upgrade
discovery
lirantal
software
EPSS
0.002
Percentile
57.8%
Versions of pullit prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.
Recommendation
Upgrade to version 1.4.0 or later.
Credits
This vulnerability was discovered by @lirantal
Related
nvd
nvd
CVE-2018-25083
2023-03-27 03:15:07
osv
osv
CVE-2018-25083
2023-03-27 03:15:07
pullit Command Injection vulnerability
2023-03-27 03:30:16
cvelist
cvelist
CVE-2018-25083
2023-03-27 00:00:00
prion
prion
Command injection
2023-03-27 03:15:00
github
github
pullit vulnerable to command injection
2020-09-03 16:47:30
veracode
veracode
Arbitrary Command Execution
2023-04-03 18:34:35
cve
cve
CVE-2018-25083
2023-03-27 03:15:07