Vulnerability Details CVE-2017-1000451
fs-git is a file system like api for git repository. The fs-git version 1.0.1 module relies on child_process.exec, however, the buildCommand method used to construct exec strings does not properly sanitize data and is vulnerable to command injection across all methods that use it and call exec.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 61.3%
CVSS Severity
CVSS v3 Score 7.8
CVSS v2 Score 4.6
Products affected by CVE-2017-1000451
-
cpe:2.3:a:fs-git_project:fs-git:0.1.0
-
cpe:2.3:a:fs-git_project:fs-git:0.1.1
-
cpe:2.3:a:fs-git_project:fs-git:0.1.3
-
cpe:2.3:a:fs-git_project:fs-git:0.1.4
-
cpe:2.3:a:fs-git_project:fs-git:0.2.0
-
cpe:2.3:a:fs-git_project:fs-git:0.2.1
-
cpe:2.3:a:fs-git_project:fs-git:0.3.0
-
cpe:2.3:a:fs-git_project:fs-git:0.4.0
-
cpe:2.3:a:fs-git_project:fs-git:0.4.1
-
cpe:2.3:a:fs-git_project:fs-git:0.5.0
-
cpe:2.3:a:fs-git_project:fs-git:0.5.1
-
cpe:2.3:a:fs-git_project:fs-git:1.0.0
-
cpe:2.3:a:fs-git_project:fs-git:1.0.1