Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Async-git Project records in CISA KEVNo Async-git Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority MEDIUM 50
The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05387 · Published 2021-01-21 · Fixed in 1.13.2 CWE-78
Priority MEDIUM 47
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02549 · Published 2021-02-18 · Fixed in 1.13.2 CWE-78
