GO-2023-1519

Command injection in github.com/rancher/wrangler

At a glance

Published: 2023-02-14 19:34 UTC
Updated: 2024-05-20 16:03 UTC
CVE: CVE-2022-31249
Aliases: GHSA-qrg7-hfx7-95c5

Description

A command injection vulnerability exists in the Wrangler Git package. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host. A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.

Affected packages

Package	Versions
Go · github.com/rancher/wrangler	introduced 0, fixed 0.7.4-security1, introduced 0.8.0, fixed 0.8.5-security1, introduced 0.8.6, fixed 0.8.11, introduced 1.0.0, fixed 1.0.1

References

https://github.com/advisories/GHSA-qrg7-hfx7-95c5 ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database