—
GO-2023-1519
Command injection in github.com/rancher/wrangler
Quick fix
GO-2023-1519 — github.com/rancher/wrangler: upgrade to the fixed version with the command below.
go get github.com/rancher/wrangler@v0.7.4-security1Details
A command injection vulnerability exists in the Wrangler Git package. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host.
A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/rancher/wrangler
Introduced in:
0Fixed in: 0.7.4-security1Fix
go get github.com/rancher/wrangler@v0.7.4-security1