Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo() fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject arguments to the git binary.
{ "nvd_published_at": "2023-06-28T05:15:10Z", "cwe_ids": [ "CWE-77", "CWE-78" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-06-30T20:32:34Z" }