Security Advisory

CVE-2022-21187

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2022-03-14 17:15:17

Last updated 2024-09-16 18:13:45

Assigner snyk

CVSS score 8.1

State PUBLISHED

Description

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.

← Browse all CVEs View on cve.org ↗