cve/2022/CVE-2022-25865.md

### [CVE-2022-25865](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25865)
![](https://img.shields.io/static/v1?label=Product&message=workspace-tools&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%200.18.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brighgreen)

### Description

The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function, both the remote and remoteBranch parameters are passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

### POC

#### Reference
- https://snyk.io/vuln/SNYK-JS-WORKSPACETOOLS-2421201

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/dellalibera/dellalibera
- https://github.com/martinthong125/POC-workspace-tools