| 标题 | Node.js @release-it/conventional-changelog 11.0.1 OS Command Injection |
|---|
| 描述 | @release-it/conventional-changelog passes the infile option directly into a shell command when the changelog file does not already exist.
The README documents infile as a filename used to write the changelog, and also documents that plugin options can be set from the command line:
release-it --plugins.@release-it/conventional-changelog.infile=history.md
In index.js, writeChangelog() writes the changelog to infile and then stages it with:
await this.exec(`git add ${infile}`);
Because infile is not escaped before being embedded in the shell command, shell metacharacters in the filename can execute additional commands.
This may be considered expected behavior or out of scope depending on the project's threat model, because release-it configuration is often treated as trusted project configuration and release pipelines commonly allow trusted maintainers to execute commands. However, from a vulnerability perspective, the specific infile option is documented as a changelog filename, not as a shell command, and it is later interpolated into git add ${infile} without escaping. I believe it is worth fixing defensively. |
|---|
| 来源 | ⚠️ https://github.com/release-it/conventional-changelog/issues/149 |
|---|
| 用户 | wjm2 (UID 99050) |
|---|
| 提交 | 2026-06-17 09時03分 (1 月前) |
|---|
| 管理 | 2026-07-23 09時39分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 382479 [release-it conventional-changelog 直到 11.0.1 Changelog File index.js writeChangelog infile 权限提升] |
|---|
| 积分 | 20 |
|---|