CVE-2023-26134

Versions of the git-commit-info package prior to 2.0.2 are vulnerable to Command Injection . The root cause is that the package-exported method gitCommitInfo() fails to sanitize its commit parameter, which is subsequently passed to a sensitive command execution API. This allows an attacker who co...