Registrator GitHub App Shell Script Injection Vulnerability in `withpasswd` Function Allowing Potential Remote Code Execution

A command injection vulnerability has been identified in the Registrator GitHub app, specifically in versions prior to 1.9.5. The issue arises within the `withpasswd` function, where dynamic variables can be interpolated into a shell script. If the clone URL from GitHub is malicious or can be manipulated through upstream vulnerabilities, this could lead to shell script injection. Additionally, an argument injection vulnerability exists in the `gettreesha` function, which could also result in remote code execution.

Impact

Exploitation of this vulnerability allows for shell script injection, which can lead to remote code execution.

Remediation

Users are advised to upgrade to Registrator version 1.9.5, where this vulnerability has been patched.