{"id":"CVE-2021-44685","aliases":["EUVD-2021-2605","GHSA-wjqc-j537-j9gj"],"status":"published","title":"Command injection in git-it-electron","description":"Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.03467,"percentile":0.89219,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2021-12-06T23:38:39Z","modified":"2026-10-20T10:55:07Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"git-it-electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.3.0"}]}]},{"source":"osv","ecosystem":"npm","package":"git-it-electron","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.3.0"}]}]}],"products":[{"vendor":"git-it_project","product":"git-it"}],"references":[{"url":"https://github.com/dwisiswant0/advisory/issues/3","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/jlord/git-it-electron/releases","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44685","tags":["advisory"]},{"url":"https://advisory.dw1.io/3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wjqc-j537-j9gj"},{"url":"https://github.com/jlord/git-it-electron","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-44685","description":"Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).","status":"published","published":"2021-12-06T23:38:39Z","modified":"2024-08-04T04:25:16.916Z","updated_at":"2026-11-02T14:33:01.166399Z"}],"euvd":[{"id":"EUVD-2021-2605","description":"Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).","status":"published","published":"2021-12-06T23:38:39Z","modified":"2024-08-04T04:25:16Z","updated_at":"2026-11-03T03:24:12.005069Z"}],"ghsa":[{"id":"GHSA-wjqc-j537-j9gj","title":"Command injection in git-it-electron","description":"Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).","status":"published","published":"2021-12-08T00:01:44Z","modified":"2023-01-27T05:05:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:36:21.8171Z"}],"nvd":[{"id":"CVE-2021-44685","description":"Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).","status":"published","published":"2021-12-07T00:15:08.043Z","modified":"2026-06-17T04:12:41.407Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:01.811115Z"}],"osv":[{"id":"CVE-2021-44685","description":"Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).","status":"published","published":"2021-12-07T00:15:08.043Z","modified":"2026-10-20T10:55:07.161872776Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"GHSA-wjqc-j537-j9gj","title":"Command injection in git-it-electron","description":"Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).","status":"published","published":"2021-12-08T00:01:44Z","modified":"2023-11-08T04:07:18.15202Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:58.767335Z"}]}}