CVE-2026-11572

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-11572

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11572.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-11572

Published

2026-06-09T05:00:04.627Z

Modified

2026-07-08T07:59:45.710674663Z

Severity

7.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

[none]

Details

Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec() method by _cloneWithGit() and fetchRefs() functions. An attacker can execute arbitrary operating system commands as the process user by supplying a specially crafted git repository name.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11572.json",
    "cna_assigner": "snyk",
    "cwe_ids": [
        "CWE-78"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "2.8.6"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/rich-harris/degit

Affected ranges

Type

GIT

Repo

https://github.com/rich-harris/degit

Events

Introduced

182dd82e100aaa24c69d406dc2317b82bef61adc

Fixed

d55bfd7cea79c0b387f69ec8477b6c34abf9f226

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.3.1"
        }
    ]
}

Affected versions

v3.*

v3.0.0

v3.1.0

v3.1.1

v3.1.2

v3.2.0

v3.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11572.json"