CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-44685
Critical (9.8) in git-it project git-it. EPSS 3.5% chance of exploitation in the next 30 days.
Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).
Severity
- EPSS
- 3.5% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- git-it_project:git-it
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wjqc-j537-j9gj | npm | git-it-electron | <=4.3.0 | no fix published |