CVE-2021-32673
Remote Command Execution in reg-keygen-git-hash-plugin
reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and including 0.10.15 allow remote attackers to execute of arbitrary commands. Upgrade to version 0.10.16 or later to resolve this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Remote Command Execution in reg-keygen-git-hash-plugin
reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and including 0.10.15 allow remote attackers to execute of arbitrary commands. Upgrade to version 0.10.16 or later to resolve this issue.
- Record
CVE-2021-32673- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2021-1258
reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and including 0.10.15 allow remote attackers to execute of arbitrary commands. Upgrade to version 0.10.16 or later to resolve this issue.
- Record
EUVD-2021-1258- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-49q3-8867-5wmp
Remote Command Execution in reg-keygen-git-hash-plugin
Impact
reg-keygen-git-hash-plugin through 0.10.15 allow remote attackers to execute of arbitrary commands.
Patches
Upgrade to version 0.10.16 or later.
For more information
If you have any questions or comments about this advisory:
- Open an issue in reg-viz/reg-suit
- Record
GHSA-49q3-8867-5wmp- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-78, CWE-94
- Updated
- 2026-11-02
NVD
reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and including 0.10.15 allow remote attackers to execute of arbitrary commands. Upgrade to version 0.10.16 or later to resolve this issue.
- Record
CVE-2021-32673- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94, CWE-78
- Updated
- 2026-11-02
OSV
reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and including 0.10.15 allow remote attackers to execute of arbitrary commands. Upgrade to version 0.10.16 or later to resolve this issue.
- Record
CVE-2021-32673- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-49q3-8867-5wmp
Remote Command Execution in reg-keygen-git-hash-plugin
Impact
reg-keygen-git-hash-plugin through 0.10.15 allow remote attackers to execute of arbitrary commands.
Patches
Upgrade to version 0.10.16 or later.
For more information
If you have any questions or comments about this advisory:
- Open an issue in reg-viz/reg-suit
- Record
GHSA-49q3-8867-5wmp- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-78, CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
reg-keygen-git-hash-pluginnpm |
before 0.10.16 | 0.10.16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-32673 is a high vulnerability (CVSS 8.8) in Reg-keygen-git-hash Project Reg-keygen-git-hash, published June 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.94%, the 80th percentile. Fixed in reg-keygen-git-hash-plugin 0.10.16.
References
github.com/reg-viz/reg-suit/security/advisories/GHSA-49q3-8867-5wmp
npmjs.com/package/reg-keygen-git-hash-plugin
nvd.nist.gov/vuln/detail/CVE-2021-32673