CVE-2021-3190

Katalog CVE

CVSS 9.8 · Critical EPSS 5,3%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada async-git project async-git. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.

Rincian

Terbit di NVD

26 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

5,3% peluang dieksploitasi; lebih tinggi dari 92,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/omrilotan/async-git/pull/13/commits/611823bd97dd41e9e8127c38066868ff9dcfa57a patch · advisory pihak ketiga
• https://github.com/omrilotan/async-git/pull/13/commits/a5f45f58941006c4cc1699609383b533d9b92c6a patch · advisory pihak ketiga
• https://github.com/omrilotan/async-git/pull/14 patch · advisory pihak ketiga
• https://advisory.checkmarx.net/advisory/CX-2021-4772 exploit · advisory pihak ketiga
• https://github.com/omrilotan/async-git/pull/13 advisory pihak ketiga