{"url":"http://public2.vulnerablecode.io/api/packages/98006?format=json","purl":"pkg:gem/git-fastclone@0.0.3","type":"gem","namespace":"","name":"git-fastclone","version":"0.0.3","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"1.0.6","latest_non_vulnerable_version":"1.0.6","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/11054?format=json","vulnerability_id":"VCID-t8bf-rs82-hyd9","summary":"Arbitrary shell command execution from .gitmodules\nGit allows executing arbitrary shell commands using `git-remote-ext` via remote\nURLs. Normally git never requests URLs that the user does not specifically request, so this is not a serious security concern. However, submodules did allow the remote repository to specify what URL to clone from. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8968","reference_id":"","reference_type":"","scores":[{"value":"0.02844","scoring_system":"epss","scoring_elements":"0.86468","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8968"},{"reference_url":"https://github.com/square/git-fastclone","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/square/git-fastclone"},{"reference_url":"https://github.com/square/git-fastclone/pull/2","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/square/git-fastclone/pull/2"},{"reference_url":"https://hackerone.com/reports/104465","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3","scoring_elements":""},{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://hackerone.com/reports/104465"},{"reference_url":"https://web.archive.org/web/20200227213019/http://www.securityfocus.com/bid/81433","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20200227213019/http://www.securityfocus.com/bid/81433"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8968","reference_id":"CVE-2015-8968","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8968"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git-fastclone/CVE-2015-8968.yml","reference_id":"CVE-2015-8968.YML","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git-fastclone/CVE-2015-8968.yml"},{"reference_url":"https://github.com/advisories/GHSA-8gg6-3r63-25m8","reference_id":"GHSA-8gg6-3r63-25m8","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8gg6-3r63-25m8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51928?format=json","purl":"pkg:gem/git-fastclone@1.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ytsu-gw5r-qbb1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/git-fastclone@1.0.1"}],"aliases":["CVE-2015-8968","GHSA-8gg6-3r63-25m8"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-t8bf-rs82-hyd9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/11055?format=json","vulnerability_id":"VCID-ytsu-gw5r-qbb1","summary":"Shell Metacharacter Injection Arbitrary Command Execution\nThe library passes user modifiable strings directly to a shell command. An attacker\ncan execute malicious commands by modifying the strings that are passed as arguments to `cd ` and `git clone ` commands in the library.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8969","reference_id":"","reference_type":"","scores":[{"value":"0.02489","scoring_system":"epss","scoring_elements":"0.85561","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8969"},{"reference_url":"https://github.com/square/git-fastclone","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/square/git-fastclone"},{"reference_url":"https://github.com/square/git-fastclone/pull/5","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/square/git-fastclone/pull/5"},{"reference_url":"https://hackerone.com/reports/105190","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3","scoring_elements":""},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://hackerone.com/reports/105190"},{"reference_url":"https://web.archive.org/web/20161108132238/http://www.securityfocus.com/bid/81433","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20161108132238/http://www.securityfocus.com/bid/81433"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8969","reference_id":"CVE-2015-8969","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8969"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git-fastclone/CVE-2015-8969.yml","reference_id":"CVE-2015-8969.YML","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git-fastclone/CVE-2015-8969.yml"},{"reference_url":"https://github.com/advisories/GHSA-mf6w-45cf-qhmp","reference_id":"GHSA-mf6w-45cf-qhmp","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mf6w-45cf-qhmp"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/73854?format=json","purl":"pkg:gem/git-fastclone@1.0.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/git-fastclone@1.0.5"},{"url":"http://public2.vulnerablecode.io/api/packages/51929?format=json","purl":"pkg:gem/git-fastclone@1.0.6","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/git-fastclone@1.0.6"}],"aliases":["CVE-2015-8969","GHSA-mf6w-45cf-qhmp"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ytsu-gw5r-qbb1"}],"fixing_vulnerabilities":[],"risk_score":"4.5","resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/git-fastclone@0.0.3"}