Async-git Project

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Async-git Project records in CISA KEV

No Async-git Project vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

2 records in Async-git · all components

TI-2021-02266 CVE-2021-3190 · GHSA-6c3f-p5wp-34mh

MEDIUM 50

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05387 Published 2021-01-21 Fixed in 1.13.2 CWE-78

TI-2020-17295 CVE-2020-28490 · GHSA-6qpr-9mc5-7gch

MEDIUM 47

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02549 Published 2021-02-18 Fixed in 1.13.2 CWE-78