packages:
  - module: github.com/Masterminds/vcs
    symbols:
      - BzrRepo.Get
      - BzrRepo.Init
      - BzrRepo.Ping
      - BzrRepo.ExportDir
      - GitRepo.Get
      - GitRepo.Init
      - GitRepo.Update
      - HgRepo.Get
      - HgRepo.Init
      - HgRepo.Ping
      - HgRepo.ExportDir
      - NewSvnRepo
      - SvnRepo.Get
      - SvnRepo.Ping
      - SvnRepo.ExportDir
    derived_symbols:
      - NewRepo
    versions:
      - fixed: 1.13.3
    vulnerable_at: 1.13.1
description: |
    Passing untrusted inputs to VCS functions can permit an attacker
    to execute arbitrary commands.

    The vcs package executes version control commands with
    user-provided arguments.  These arguments can be interpreted
    as command-line flags, which can be used to perform command
    injection.
cves:
  - CVE-2022-21235
ghsas:
  - GHSA-6635-c626-vj4r
credit: Alessio Della Libera of Snyk Research Team
links:
    pr: https://github.com/Masterminds/vcs/pull/105