CVE-2023-26134

Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they control the hash content.

• CWE-78
• CWE-77

• https://github.com/JPeer264/node-git-commit-info/commit/f7c491ede51f886a988af9b266797cb24591d18cPatch
• https://github.com/JPeer264/node-git-commit-info/issues/24Exploit, Issue Tracking
• https://security.snyk.io/vuln/SNYK-JS-GITCOMMITINFO-5740174Exploit, Third Party Advisory
• https://github.com/JPeer264/node-git-commit-info/commit/f7c491ede51f886a988af9b266797cb24591d18cPatch
• https://github.com/JPeer264/node-git-commit-info/issues/24Exploit, Issue Tracking
• https://security.snyk.io/vuln/SNYK-JS-GITCOMMITINFO-5740174Exploit, Third Party Advisory

Published

Jun 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26128All versions of the package keep-module-latest are vulnerabl…7.8
• CVE-2023-26129All versions of the package bwm-ng are vulnerable to Command…7.8
• CVE-2023-26130Versions of the package yhirose/cpp-httplib before 0.12.4 ar…8.8
• CVE-2023-26131All versions of the package github.com/xyproto/algernon/engi…6.1
• CVE-2023-26132Versions of the package dottie before 2.0.4 are vulnerable t…7.5
• CVE-2023-26133All versions of the package progressbar.js are vulnerable to…9.8
• CVE-2023-26135All versions of the package flatnest are vulnerable to Proto…9.8
• CVE-2023-26136Versions of the package tough-cookie before 4.1.3 are vulner…9.8
• CVE-2023-26137All versions of the package drogonframework/drogon are vulne…6.1
• CVE-2023-26138All versions of the package drogonframework/drogon are vulne…4.3
• CVE-2023-26139Versions of the package underscore-keypath from 0.0.11 are v…7.5
• CVE-2023-2614Cross-site Scripting (XSS) - DOM in GitHub repository pimcor…5.4