Dotan Simha

**Name of the Vulnerable Software and Affected Versions** @graphql-tools/git-loader versions prior to 6.2.6 **Description** The issue allows for arbitrary command injection due to the use of `exec` and `execSync` in the `load-git.ts` file. This is a result of the package's design, which enables an attacker to inject malicious commands. **Recommendations** For versions prior to 6.2.6, update to version 6.2.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the `load-git.ts` file or disabling the use of `exec` and `execSync` functions until a patch is applied.