Back to overview

CVE-2026-11572

HIGH Exploitation: PoC
8.8
CVSS 3.1
Description
Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec() method by _cloneWithGit() and fetchRefs() functions. An attacker can execute arbitrary operating system commands as the process user by supplying a specially crafted git repository name.

Metadata

CVE ID
CVE-2026-11572
State
PUBLISHED
Assigner
snyk
Reserved
2026-06-08 09:46 UTC
Published
2026-06-09 05:00 UTC
Last updated
2026-06-09 13:14 UTC
Primary CWE
CWE-78
Command Injection
Vendor / Product
n/a / degit
Sources
cve.org  ·  NVD

Severity & Metrics

8.8 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
n/a degit — 0 < 2.8.6, 3.0.0 < 3.3.1
Weakness (CWE)
CWESourceDescription
CWE-78 cna Command Injection
CWE-77 adp CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVSS scores (2)
ScoreSeverityVersionSourceVector
8.8 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P
8.7 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
References (4)
Back to overview