Improper Handling of Alternate Data Stream
Affecting org.webjars.npm:nodegit artifact, versions [0,]Report new vulnerabilities
org.webjars.npm:nodegit is a Node bindings to the libgit2 project.
Affected versions of this package are vulnerable to Improper Handling of Alternate Data Stream. Git was unaware of NTFS Alternate Data Streams, allowing files inside the
.git/ directory to be overwritten during a clone.
While the description contains "NTFS", this vulnerability can not only be exploited on Windows, but also on macOS when working on
smb://-mounted network shares. The exploit involves naming a directory
.git::$INDEX_ALLOCATION, allowing remote code execution during a regular
The fix for this CVE requires the fix for CVE-2019-1353.
There is no fixed version for