CRITICAL9.8
GHSA-926x-m6m5-3mmp
push-dir Enables OS Command Injection
Details
push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable `opt.branch` is not validated before being provided to the `git` command within [index.js#L139](https://github.com/L33T-KR3W/push-dir/blob/master/index.js#L139). This could be abused by an attacker to inject arbitrary commands.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/push-dir
Introduced in:
0No fixed version published yet for push-dir (npm). Pin to a known-safe version or switch to an alternative.