Description
The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | libvcs | unspecified – < 0.11.1 | 0.11.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | libvcs | < 0.11.1 | 0.11.1 | GHSA-mv2w-4jqc-6fg4 |
| PyPI | vcspull | < 1.11.1 | 1.11.1 | GHSA-mv2w-4jqc-6fg4 |