PT-2025-39374 · Unknown · Git-Commiters

Published 2025-09-22 · Updated 2025-09-25 · CVE-2025-59831

Positive Technologies · (AI Summary)

CVSS v4.0

8.7

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

**Name of the Vulnerable Software and Affected Versions**

git-commiters versions prior to 0.1.2

**Description**

git-commiters is a Node.js function module used to provide committers statistics for a git repository. A command injection issue exists due to insufficient input sanitization and insecure process execution. The primary API, `gitCommiters(options, callback)`, is affected, specifically when utilizing the `cwd` (current working directory) and `revisionRange` options. User-supplied input is concatenated into command execution without proper separation of commands and arguments, potentially allowing for arbitrary command execution.

**Recommendations**

Update git-commiters to version 0.1.2 or later.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2025-59831

GHSA-G38C-WXJF-XRH6

Affected Products

Git-Commiters

References · 11

• 🔥 https://github.com/snowyu/git-commiters.js/security/advisories/GHSA-g38c-wxjf-xrh6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59831 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59831 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g38c-wxjf-xrh6 · Vendor Advisory
• https://github.com/snowyu/git-commiters.js · Note
• https://github.com/snowyu/git-commiters.js/commit/7f0abfedbf506e3a61ac875d91324a8dbe756e84 · Note
• https://t.me/cveNotify/136401 · Telegram Post
• https://t.me/CVEtracker/33317 · Telegram Post
• https://twitter.com/CVEnew/status/1971211274399682751 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1971225482084442217 · Twitter Post
• https://twitter.com/CveFindCom/status/1971215631119708255 · Twitter Post