CVE-2024-21532

All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched and then concatenates this string along with a git command which is then passed to the unsafe exec() Node.js child process API.

Affected

ggit

CVSS v4.0 GitHub

6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS v3.1 SNYK

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

1.29% chance of exploitation in the next 30 days, 70th percentile

Published

2024-10-08

Updated

2026-03-21

Proof-of-concept exploits (1)

• lirantal/CVE-2024-21532-PoC-ggit0★ · 2026-06-14

Security advisories

• advisories/GHSA-62cx-5xj4-wfm4

References

• CVE Record
• NVD entry

Related

• CVE-2019-10760
• CVE-2020-7598
• CVE-2024-21533
• CVE-2024-27983
• CVE-2025-29927