~ / search / GHSA-77c7-pq4r-6mcq

GHSA-77c7-pq4r-6mcq

degit has a Command Injection issue

Source: GitHub Advisory Database (reviewed) High CVE-2026-11572

Packages

EcosystemPackageAffectedFixed in
npm degit < 2.8.6 2.8.6
npm degit >= 3.0.0, < 3.3.1 3.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec() method by _cloneWithGit() and fetchRefs() functions. An attacker can execute arbitrary operating system commands as the process user by supplying a specially crafted git repository name.

References

External links from the advisory. They lead to third-party sites.