CVE-2022-21187
High
Description
The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.
SeverityHigh
CVSS8.1
Exploit probability—
ProductLibvcs
PublishedMar 14, 2022
First seenMar 14, 2022
How to fix
Update
- libvcs_project libvcs0.11.1 or later
- libvcs0.11.1 or later
- vcspull1.11.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libvcs_project libvcs | v < 0.11.1 | 0.11.1 |
| libvcsPyPI | v < 0.11.1 | 0.11.1 |
| vcspullPyPI | v < 1.11.1 | 1.11.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.