CVE-2022-24437

Deeper analysis

The package git-pull-or-clone before version 2.0.2 is vulnerable to command injection. The issue stems from unsafe handling of the outpath parameter when invoking git clone, which accepts the --upload-pack flag; although the code uses the spawn() child-process API, attacker-controlled values supplied to outpath are concatenated into the command line and executed.

An unauthenticated remote attacker can supply a malicious outpath value over the network, resulting in arbitrary command execution on the target system with the privileges of the calling process. Successful exploitation yields full confidentiality, integrity, and availability impact, consistent with the CVSS 9.8 rating.

Public references, including the Snyk advisory and the project’s own commit history, indicate that the vulnerability is resolved by upgrading to git-pull-or-clone 2.0.2 or later; the fix ensures that outpath is no longer interpreted as a command-line argument to git clone. The associated EPSS score has remained flat at 0.1039 with no material increase since disclosure.