npm package report

Is git-commit-info safe?

1 known vulnerability, worst severity HIGH.

cvss

9.8

how bad it is if exploited, out of 10

epss

3.6%

chance of exploitation in the next 30 days

xyz score

3.9

CyberXYZ composite, out of 10

fig. 01 — GHSA-h42j-mrmp-9369, the advisory selected below

// advisories

GHSA-h42j-mrmp-9369

HIGHCVE-2023-26134

Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo() fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject arguments to the git binary.

Affected: < 2.0.2
Fixed in: 2.0.2
Published: 2023-06-28
Source: github

GHSA NVD MITRE reference reference reference reference

// dependencies

2 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 01:30 UTC. The most recent advisory here was published 2023-06-28. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is git-commit-info safe? npm package security report | CyberXYZ