PT-2026-47686 · Undefined · Undefined

Amar Khatri + 1 · Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-11572

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec() method by cloneWithGit() and fetchRefs() functions. An attacker can execute arbitrary operating system commands as the process user by supplying a specially crafted git repository name.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-11572

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-11572 · Security Note
• https://github.com/Rich-Harris/degit/commit/4ac99e4a4c3f53ca3b5c997bcd7542742ad0c443 · Note
• https://gist.github.com/badp3te/cf22a939eedbd3d8ade9123827d61639 · Note
• https://github.com/Rich-Harris/degit/commit/d55bfd7cea79c0b387f69ec8477b6c34abf9f226 · Note
• https://security.snyk.io/vuln/SNYK-JS-DEGIT-17116207 · Note