Command Injection Vulnerability in Git Commit Info by JPeer264

CVE-2023-26134

What is CVE-2023-26134?

The git-commit-info package, prior to version 2.0.2, has a command injection vulnerability in its exported method gitCommitInfo(). This occurs due to inadequate sanitization of the 'commit' parameter, allowing attackers the potential to execute arbitrary commands through its integration with sensitive command execution APIs. By controlling the hash content, an attacker can leverage this flaw to run malicious commands, posing significant risks to the integrity and security of affected applications.

References