microsoft/workspace-tools

microsoft/workspace-tools

GitHubGitHub
GitHubgithub.com
microsoft.github.iomicrosoft.github.io
Releases126
Frequency2 weeks 2 days
Last Release
Stars110
Repo has been merged into https://github.com/microsoft/lage
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2022-25865↗
8.1 HIGH7.5 HIGH

The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function, both the remote and remoteBranch parameters are passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.