| Название | Node.js @release-it/conventional-changelog 11.0.1 OS Command Injection |
|---|
| Описание | @release-it/conventional-changelog passes the infile option directly into a shell command when the changelog file does not already exist.
The README documents infile as a filename used to write the changelog, and also documents that plugin options can be set from the command line:
release-it --plugins.@release-it/conventional-changelog.infile=history.md
In index.js, writeChangelog() writes the changelog to infile and then stages it with:
await this.exec(`git add ${infile}`);
Because infile is not escaped before being embedded in the shell command, shell metacharacters in the filename can execute additional commands.
This may be considered expected behavior or out of scope depending on the project's threat model, because release-it configuration is often treated as trusted project configuration and release pipelines commonly allow trusted maintainers to execute commands. However, from a vulnerability perspective, the specific infile option is documented as a changelog filename, not as a shell command, and it is later interpolated into git add ${infile} without escaping. I believe it is worth fixing defensively. |
|---|
| Источник | ⚠️ https://github.com/release-it/conventional-changelog/issues/149 |
|---|
| Пользователь | wjm2 (UID 99050) |
|---|
| Представление | 17.06.2026 09:03 (1 месяц назад) |
|---|
| Модерация | 23.07.2026 09:39 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 382479 [release-it conventional-changelog до 11.0.1 Changelog File index.js writeChangelog infile эскалация привилегий] |
|---|
| Баллы | 20 |
|---|