CVE-2025-59433

Executive Summary

CVE-2025-59433 is an argument injection vulnerability in the @conventional-changelog/git-client library, part of the Conventional Changelog ecosystem. The flaw resides in the getTags() API, which fails to sanitize user-supplied parameters before passing them to the git log command. Unlike the getRawCommits() API, which uses the -- separator to prevent argument injection, getTags() does not implement this safeguard. An attacker can exploit this by injecting the --output= Git option, leading to arbitrary file overwrite on the host system. The vulnerability has a CVSS score of 5.3 (Medium) and is patched in version 2.0.0.

Supply Chain & Package Security

This vulnerability affects the npm package @conventional-changelog/git-client. Organizations using this package in their CI/CD pipelines or development workflows are at risk. An attacker could craft a malicious commit message or tag name that, when processed by the vulnerable library, overwrites critical files (e.g., .git/config, build scripts, or deployment artifacts). This could lead to supply chain compromise, especially if the library is used in automated release generation processes.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low integrity impact reflects the ability to overwrite arbitrary files, but not to read or disrupt services directly. However, in a CI/CD context, this can be escalated to full compromise.

Deep Dive & Mechanics

The vulnerability is a classic argument injection in a Git command. The getTags() function in @conventional-changelog/git-client constructs a Git command like:

git log --tags --simplify-by-decoration --pretty="format:%h %H %s" [user_input]

The user_input is passed directly without sanitization. Git has a dangerous option --output=<file> that writes the output to a specified file. By injecting --output=/path/to/target, an attacker can overwrite any file the process has write access to.

For example, if an attacker controls the tag name or a parameter passed to getTags(), they can set it to:

--output=/etc/passwd

This would cause the Git command to write its output to /etc/passwd, potentially corrupting the system.

The getRawCommits() API mitigates this by appending -- to the command, which tells Git that all subsequent arguments are paths, not options. The getTags() API does not do this.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.0.0):

// In getTags() function
const args = ['log', '--tags', '--simplify-by-decoration', '--pretty="format:%h %H %s"'];
if (userInput) {
  args.push(userInput); // No sanitization, no '--' separator
}
const output = execSync('git', args);

Patched Code (2.0.0):

// In getTags() function
const args = ['log', '--tags', '--simplify-by-decoration', '--pretty="format:%h %H %s"'];
if (userInput) {
  args.push('--'); // End of options
  args.push(userInput); // Now treated as path, not option
}
const output = execSync('git', args);

The patch adds -- before the user input, preventing argument injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target system running a vulnerable version of @conventional-changelog/git-client (< 2.0.0).
• Ability to influence the input to getTags() (e.g., via a malicious commit message or tag name in a repository processed by the library).

Exploitation Steps:

1. Identify the vulnerable endpoint: Find where the application calls getTags() with user-controlled input. This could be in a CI/CD pipeline that processes tags from a repository.

2. Craft the payload: Inject the --output option to overwrite a target file. For example, to overwrite the .git/config file:

   --output=.git/config
   

3. Trigger the vulnerability: Submit a commit or tag with the malicious payload. When the library processes it, the Git command will write output to the specified file.

4. Escalate: Overwriting .git/config can allow an attacker to modify Git remotes, hooks, or other settings, leading to further compromise.

Example Payload:

git tag -a "v1.0.0 --output=.git/config" -m "Release v1.0.0"
git push origin v1.0.0

When the vulnerable library runs getTags(), it will execute:

git log --tags --simplify-by-decoration --pretty="format:%h %H %s" v1.0.0 --output=.git/config

This overwrites .git/config with the Git log output.

Blue Team

Detection:

• Monitor for unusual Git commands that include --output options.
• Audit usage of @conventional-changelog/git-client in your environment.
• Check for unexpected file modifications, especially in .git directories or critical system files.

Prevention:

• Immediately upgrade to version 2.0.0 or later.
• If upgrade is not possible, implement input validation to reject any input containing --output or other dangerous Git options.
• Use a Web Application Firewall (WAF) or runtime security tool to detect and block argument injection attempts.

Indicators of Compromise (IOCs)

• File System: Unexpected files in .git directory (e.g., .git/config with Git log output).
• Process: Git processes with --output argument in the command line.
• Logs: Git commands containing --output in application logs or system logs.
• Network: Unusual outbound connections from CI/CD systems (if attacker exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2025_59433_Argument_Injection {
  meta:
    description = "Detects argument injection in @conventional-changelog/git-client getTags()"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-59433"
  strings:
    $git_output = /git\s+log\s+.*--output=/ nocase
    $vuln_call = /getTags\s*\(/ nocase
  condition:
    $git_output or $vuln_call
}

Sigma Rule

title: CVE-2025-59433 Argument Injection in @conventional-changelog/git-client
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects Git commands with --output option, indicating exploitation of CVE-2025-59433
author: Valters IT
date: 2025-04-10
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\git.exe'
    CommandLine|contains: '--output='
  condition: selection
falsepositives:
  - Legitimate use of --output in Git commands (rare)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-59433 Git Argument Injection"; flow:to_server,established; content:"git"; nocase; content:"--output="; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade @conventional-changelog/git-client to version 2.0.0 or later.
2. Workaround: If upgrade is not possible, sanitize all user input passed to getTags() by stripping or escaping dangerous Git options (e.g., --output).
3. Long-term: Implement input validation and allow-listing for all external inputs in your application. Use parameterized commands or libraries that prevent injection.
4. Monitoring: Deploy the detection rules above to identify exploitation attempts.
5. Audit: Review all uses of getTags() in your codebase and ensure they are not exposed to untrusted input.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert