CVE-2024-21533
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
11th
All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL to clone and the file on disk to clone to. The library does not sanitize for user input or validate a given URL scheme, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.
| CWE | CWE-88 |
| Vendor | n/a |
| Product | ggit |
| Published | Oct 8, 2024 |
| Last Updated | Mar 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a ggit
Be the first to know when new medium vulnerabilities affecting n/a ggit are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
n/a / ggit
0 < *
References
Credits
Liran Tal