Filtered by vendor Libvcs Project Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-21187 1 Libvcs Project 1 Libvcs 2024-11-21 8.1 High
The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.