Description
The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Scores
CVSS v3
8.1
EPSS
0.0199
EPSS Percentile
83.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-88
Status
published
Products (2)
czproject/git-php
0 - 4.0.3Packagist
git-php_project/git-php
< 4.0.3
Published
Apr 25, 2022
Tracked Since
Feb 18, 2026