Daily briefing

News

What broke, who's patching it, and what to do about it. New briefs land most weekdays — usually within hours of the underlying advisory.

1 new in the last 24h · 30 in the last 7 days · 291 briefs total

25 Apr
simple-git patches RCE via --config option injection
`simple-git` blocked `-c` but not `--config`. Attacker-controlled options can set `protocol.ext.allow=always` and trigger `ext::` clone RCE. Fixed in `3.36.0`.
NewsJavaScriptDev Tools
2 min
24 Apr
Electerm patches install-time command injection on Linux
`electerm` `runLinux()` builds an `exec("rm -rf ...")` string with attacker-controlled remote version data. Affected `< 3.3.8`. CVSS 9.8.
NewsDev ToolsSupply Chain
1 min

Loading news…

Content is AI-assisted and reviewed by our team, but issues may be missed and best practices evolve rapidly, send corrections to [email protected]. Always consult official documentation and validate key implementation decisions before making design or security choices.

simple-git patches RCE via --config option injection

Electerm patches install-time command injection on Linux

simple-git patches RCE via --config option injection

Electerm patches install-time command injection on Linux