CVE-2021-32673

Remote Command Execution in reg-keygen-git-hash-plugin

State: Published
Severity: 8.8 High
Published: Jun 8, 2021
Updated: Aug 3, 2024
Reserved: May 12, 2021

Description

reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and including 0.10.15 allow remote attackers to execute of arbitrary commands. Upgrade to version 0.10.16 or later to resolve this issue.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L	GitHub_M

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
reg-suitreg-viz	< 0.10.16Affected

References

https://github.com/reg-viz/reg-suit/security/advisories/GHSA-49q3-8867-5wmp
https://github.com/reg-viz/reg-suit/commit/f84ad9c7a22144d6c147dc175c52756c0f444d87
https://github.com/reg-viz/reg-suit/releases/tag/v0.10.16
https://www.npmjs.com/package/reg-keygen-git-hash-plugin

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.