Skip to content
OpenAdvisories

Package · npm

ungit

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.8
    CVE-2022-25766 EPSS 35%

    Remote Code Execution (RCE)

    The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git opt…

    ungit npm
  • Critical —
    CVE-2015-4130

    Command Injection in ungit

    Versions of `ungit` prior to 0.9.0 are affected by a command injection vulnerability in the `url` parameter. ## Recommendation Update version 0.9.0 or later.

    ungit npm