🚨High - degit Command Injection (CVE-2026-11572) A command injection flaw in the popular npm scaffolding tool degit lets an attacker run arbitrary OS commands. User-supplied input isn't sanitized before being passed to git shell commands executed via exec() in the _cloneWithGit() and fetchRefs() functions, so a maliciously crafted git repository name breaks out into shell command execution as the process user. Exploitation requires the victim to invoke degit against the attacker-controlled repo name, so the real risk surface is template generators, project bootstrappers, and CI pipelines that feed untrusted repository identifiers into degit. Full confidentiality, integrity, and availability impact, with a Proof-of-Concept already rated in the scoring. Affected: degit < 2.8.6 and 3.0.0 - 3.3.0. 👉Upgrade to degit 2.8.6 or 3.3.1.
Post summary
A high‑severity command injection flaw (CVE‑2026‑11572) in the npm tool degit has been disclosed, with a PoC noted and vulnerability details provided; users are advised to upgrade to affected bug‑fixed versions.