CVE-2018-25083 (JSON, published 2023-03-27T03:15Z)
Description: value: The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/jkup/pullit
Files changed:
package.json
src/index.js
Commit message: fix security vuln


Vulnerable code:
  "version": "1.3.0",
  "keywords": [
    "github",
    "pull",
    "request",
    "pr",
    "cli"
  ],
    "collectCoverageFrom": [
      "src/**/*.js"
    ],
    "modulePathIgnorePatterns": [
      "__tests__/fixtures/"
    ],
    "testPathIgnorePatterns": [
      "__tests__/fixtures/"
    ]
}
const GitHubApi = require('github');
const Menu = require('terminal-menu');
const {
  execSync
} = require('child_process');
const parse = require('parse-github-repo-url');
    const url = execSync(`git config --get remote.origin.url`, {
      encoding: 'utf8'
        execSync(
          `git fetch origin pull/${id}/head:${branch} && git checkout ${branch}`
        );
        console.log('Error: Could not find the specified pull request.');
    this.fetchRequests().then(results => {
      const menu = Menu({
       width: process.stdout.columns - 4,
        x: 0,
        y: 2
      });
      menu.reset();
      menu.write('Currently open pull requests:\n');
      menu.write('-------------------------\n');
      results.data.forEach(element => {
        menu.add(`${element.number} - ${element.title} - ${element.head.user.login}`);
      });
      menu.add(`Exit`);
      menu.on('select', label => {
        menu.close();
        this.fetch(label.split(' ')[0]);
      });
      process.stdin.pipe(menu.createStream()).pipe(process.stdout);
      process.stdin.setRawMode(true);
      menu.on('close', () => {
        process.stdin.setRawMode(false);
        process.stdin.end();
    }).catch(err => {
      console.log('Error: could not display pull requests. Please make sure this is a valid repository.')
    });

Fixed code:
  "version": "1.4.0",
  "keywords": ["github", "pull", "request", "pr", "cli"],
    "collectCoverageFrom": ["src/**/*.js"],
    "modulePathIgnorePatterns": ["__tests__/fixtures/"],
    "testPathIgnorePatterns": ["__tests__/fixtures/"]
}
const GitHubApi = require("github");
const Menu = require("terminal-menu");
const { execFileSync } = require("child_process");
const parse = require("parse-github-repo-url");
    const url = execFileSync("git", ["config", "--get", "remote.origin.url"], {
      encoding: "utf8"
        execFileSync("git", ["fetch", "origin", `pull/${id}/head:${branch}`]);
        execFileSync("git", ["checkout", branch]);
        console.log("Error: Could not find the specified pull request.");
    this.fetchRequests()
      .then(results => {
        const menu = Menu({
          width: process.stdout.columns - 4,
          x: 0,
          y: 2
        });
        menu.reset();
        menu.write("Currently open pull requests:\n");
        menu.write("-------------------------\n");
        results.data.forEach(element => {
          menu.add(
            `${element.number} - ${element.title} - ${element.head.user.login}`
          );
        });
        menu.add(`Exit`);
        menu.on("select", label => {
          menu.close();
          this.fetch(label.split(" ")[0]);
        });
        process.stdin.pipe(menu.createStream()).pipe(process.stdout);
        process.stdin.setRawMode(true);
        menu.on("close", () => {
          process.stdin.setRawMode(false);
          process.stdin.end();
        });
      })
      .catch(err => {
        console.log(
          "Error: could not display pull requests. Please make sure this is a valid repository."
        );