admin/cve
1
0
Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2025-05-05 10:17:57 +00:00
Code Issues Packages Projects Releases Wiki Activity
cve/2022/CVE-2022-21187.md
0xMarcio 48a00929ac Removed duplicates
2024-06-18 02:51:15 +02:00

792 B
Raw Permalink Blame History

CVE-2022-21187

Description

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.

POC

Reference

Github