Command injection in Git package in Wrangler
Package
Affected versions
>= 0.8.6, < 0.8.11
= 1.0.0
< 0.7.4-security1
>= 0.8.0, < 0.8.5-security1
Patched versions
0.8.11
1.0.1
0.7.4-security1
0.8.5-security1
Description
Published to the GitHub Advisory Database
Jan 25, 2023
Reviewed
Jan 25, 2023
Published by the National Vulnerability Database
Feb 7, 2023
Last updated
Jun 13, 2023
Credits
-
cokeBeer Analyst
-
aruneko Analyst
-
tdunlap607 Analyst
Impact
A command injection vulnerability was discovered in Wrangler's Git package affecting versions up to and including
v1.0.0.Wrangler's Git package uses the underlying Git binary present in the host OS or container image to execute Git operations. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host.
Workarounds
A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.
Patches
Patched versions include
v1.0.1and later and the backported tags -v0.7.4-security1,v0.8.5-security1andv0.8.11.For more information
If you have any questions or comments about this advisory:
References