Vulnerabilities CVE-2026-16492

CVE-2026-16492

Medium

Open

TLP:CLEAR

umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.6.64 is sufficient to fix this issue. Patch name: b6da12c17b024a43badb1fa565720c38cf42e647. Upgrading the affected component is advised.

Details

CVSS Score: 5.1
EPSS Score ⓘ: 1.66%

74.7th percentile
CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Confidence: 90%
Published: Jul 22, 2026
Last Modified: Jul 22, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.