A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.
[
{
"product": "git-dummy-commit",
"vendor": "https://github.com/stevemao",
"versions": [
{
"status": "affected",
"version": "Not fixed"
}
]
}
]