cve/2023/CVE-2023-26134.md

### [CVE-2023-26134](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26134)
![](https://img.shields.io/static/v1?label=Product&message=git-commit-info&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%202.0.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brighgreen)

### Description

Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they control the hash content.

### POC

#### Reference
- https://github.com/JPeer264/node-git-commit-info/issues/24
- https://security.snyk.io/vuln/SNYK-JS-GITCOMMITINFO-5740174

#### Github
No PoCs found on GitHub currently.