CVE-2019-10776

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	git-diff-apply	All versions prior to version 0.22.2

References

https://github.com/kellyselden/git-diff-apply/commit/106d61d3ae723b4257c2a13e67b95eb40a27e0b5Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-GITDIFFAPPLY-540774%2C
https://snyk.io/vuln/SNYK-JS-GITDIFFAPPLY-540774Exploit, Patch, Third Party Advisory
https://github.com/kellyselden/git-diff-apply/commit/106d61d3ae723b4257c2a13e67b95eb40a27e0b5Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-GITDIFFAPPLY-540774%2C

Timeline

Published: Jan 7, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-107779.8In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function wi CVE-2019-107789.8devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The var CVE-2019-107796.1All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An CVE-2019-10785.5An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory. An attacker who suc CVE-2019-107809.8BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open CVE-2019-107819.8In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used wit CVE-2019-107825.3All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix f CVE-2019-107839.8All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec CVE-2019-107849.6phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One CVE-2019-107856.1dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to CVE-2019-107869.8network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument.CVE-2019-107879.8im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js