npm async-git vulnerabilities

Latest npm async-git CVEs

Newest publication first

1. CVE-2020-28490 Command Injection

   Published 2021-02-18

   Critical·CVSS 9.8 EPSS 2.5%

   The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb')

2. CVE-2021-3190 OS Command Injection in async-git

   Published 2021-01-21

   Critical·CVSS 9.8 EPSS 5.4%

   The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.