CVE-2022-21187

EUVD-2022-0137
The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.
Argument Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
snykCNA
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
Affected Products (NVD)
VendorProductVersion
libvcs_projectlibvcs
𝑥
< 0.11.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/vcs-python/libvcs/blob/v0.11.1/CHANGES%23libvcs-0111-2022-03-12
https://github.com/vcs-python/libvcs/pull/306
https://snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204
https://github.com/vcs-python/libvcs/blob/v0.11.1/CHANGES%23libvcs-0111-2022-03-12
https://github.com/vcs-python/libvcs/pull/306
https://snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204