CVE-2024-21533

MEDIUM

ggit - Arbitrary Argument Injection via clone() API

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-21533. PoCs published by lirantal.

AI-analyzed exploit summary The repository contains a functional PoC for CVE-2024-21533, demonstrating an argument injection vulnerability in the `ggit` npm package. The exploit leverages improper handling of the `--upload-pack` Git option to achieve arbitrary command execution.

Description

All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL to clone and the file on disk to clone to. The library does not sanitize for user input or validate a given URL scheme, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.

Exploits (1)

nomisec WORKING POC
by lirantal · poc
https://github.com/lirantal/CVE-2024-21533-PoC-ggit

The repository contains a functional PoC for CVE-2024-21533, demonstrating an argument injection vulnerability in the `ggit` npm package. The exploit leverages improper handling of the `--upload-pack` Git option to achieve arbitrary command execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: ggit npm package (versions 2.4.12 and earlier)
No auth needed
Prerequisites: Installation of vulnerable `ggit` package (version 2.4.12 or earlier)
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 6.5
EPSS 0.0004
EPSS Percentile 13.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-88
Status published
Products (2)
n/a/ggit
npm/ggit 0npm
Published Oct 08, 2024
Tracked Since Feb 18, 2026