CVE-2022-21187 — Command Injection
The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed t…
Published: 2022-03-14 · CVSS: 8.1 · CVSS 3.1
The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7