| 제목 | Node.js @release-it/conventional-changelog 11.0.1 OS Command Injection |
|---|
| 설명 | @release-it/conventional-changelog passes the infile option directly into a shell command when the changelog file does not already exist.
The README documents infile as a filename used to write the changelog, and also documents that plugin options can be set from the command line:
release-it --plugins.@release-it/conventional-changelog.infile=history.md
In index.js, writeChangelog() writes the changelog to infile and then stages it with:
await this.exec(`git add ${infile}`);
Because infile is not escaped before being embedded in the shell command, shell metacharacters in the filename can execute additional commands.
This may be considered expected behavior or out of scope depending on the project's threat model, because release-it configuration is often treated as trusted project configuration and release pipelines commonly allow trusted maintainers to execute commands. However, from a vulnerability perspective, the specific infile option is documented as a changelog filename, not as a shell command, and it is later interpolated into git add ${infile} without escaping. I believe it is worth fixing defensively. |
|---|
| 원천 | ⚠️ https://github.com/release-it/conventional-changelog/issues/149 |
|---|
| 사용자 | wjm2 (UID 99050) |
|---|
| 제출 | 2026. 06. 17. AM 09:03 (1 월 ago) |
|---|
| 모더레이션 | 2026. 07. 23. AM 09:39 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 382479 [release-it conventional-changelog 까지 11.0.1 Changelog File index.js writeChangelog infile 권한 상승] |
|---|
| 포인트들 | 20 |
|---|