npm-git-publish is a package for sharing/publishing private packages using Git remotes.
Affected versions of this package are vulnerable to Remote Code Execution (RCE) via an insecure command formatting.
It allows to execute arbitrary commands remotely inside the victim's PC
The issue occurs because a user input is formatted inside a
command that will be executed without any check.
There is no fixed version for
- Snyk ID
- 11 Jan, 2020
- 12 Jan, 2020