CVE-2022-1440

Name of the Vulnerable Software and Affected Versions git-interface versions 2.1.1 through 2.1.1

Description A command injection issue exists in the git-interface. If both the git remote and destination directory are provided by user input, the use of a --upload-pack command-line argument feature of git is also supported for git clone, allowing any operating system command to be spawned by the attacker.

Recommendations For git-interface version 2.1.1, update to version 2.1.2 to resolve the issue. As a temporary workaround, consider restricting the use of the --upload-pack command-line argument feature of git for git clone until a patch is available.