CVE-2022-25648 The package git before 1.11.0 are vulnerable to Command Injection via git argument injection

Description

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Produits et versions touchés