Repository.php in Gitter, as used in Gitlist, allows remote attackers with commit privileges to execute arbitrary commands via shell metacharacters in a branch name, as demonstrated by a git checkout -b command.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlist | Gitlist | - (including) | - (including) |