Npm · Degit · CVE-2026-11572
**Name of the Vulnerable Software and Affected Versions**
degit versions prior to 2.8.6
degit versions 3.0.0 through 3.3.0
**Description**
Command Injection occurs due to improper sanitization of user input used in git shell commands. The ` cloneWithGit()` and `fetchRefs()` functions directly invoke these commands using the `exec()` method. An attacker can execute arbitrary operating system commands as the process user by providing a specially crafted git repository name. This issue primarily affects template generators, project bootstrappers, and CI pipelines that process untrusted repository identifiers.
**Recommendations**
Update to version 2.8.6 for versions prior to 2.8.6.
Update to version 3.3.1 for versions 3.0.0 through 3.3.0.