CVE-2026-11572

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-11572
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11572.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-11572
Aliases
Published
2026-06-09T05:00:04Z
Modified
2026-08-12T03:51:20Z
Severity
  • 7.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
[none]
Details

Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec() method by _cloneWithGit() and fetchRefs() functions. An attacker can execute arbitrary operating system commands as the process user by supplying a specially crafted git repository name.

Database specific 
{
    "cna_assigner": "snyk",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11572.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "2.8.6"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/rich-harris/degit

Affected ranges

Type
GIT
Repo
https://github.com/rich-harris/degit
Events
Introduced
182dd82e100aaa24c69d406dc2317b82bef61adc
Fixed
d55bfd7cea79c0b387f69ec8477b6c34abf9f226
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.3.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v3.*
v3.0.0
v3.1.0
v3.1.1
v3.1.2
v3.2.0
v3.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11572.json"