vcs-python/libvcs

vcs-python/libvcs

GitHubGitHub
GitHubgithub.com
libvcs.git-pull.comlibvcs.git-pull.com
Releases175
Frequency2 weeks 6 days
Last Release
Stars58
⚙️ Lite, typed, pythonic utilities for git, svn, mercurial, etc.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2022-21187↗
8.1 HIGH7.5 HIGH

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.