EUVD-2026-47596
GHSA-g3hq-vgww-mrhj
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector because malicious projects are fetched remotely; UI:R for required developer build invocation; S:C and full C/I/A for arbitrary OS command execution.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.6.64 is sufficient to fix this issue. Patch name: b6da12c17b024a43badb1fa565720c38cf42e647. Upgrading the affected component is advised.
AnalysisAI
OS command injection in umijs umi's GIT File Helper enables arbitrary shell command execution against developer workstations during project builds. All umi 4.6.x releases through 4.6.63 are affected via the getFileCreateInfo and getFileLastModifyInfo functions in packages/utils/src/getFileGitIno.ts, which invoke child processes with shell: true and pass unsanitized file paths directly to the shell. A public proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified, and umi 4.6.64 fully remediates the issue.
Technical ContextAI
umi (CPE: cpe:2.3:a:umijs:umi:*:*:*:*:*:*:*:*) is a React and frontend development framework maintained by the Alibaba/Ant Design ecosystem. The vulnerable component is the GIT File Helper utility in packages/utils/src/getFileGitIno.ts, which wraps git log invocations to extract per-file authorship metadata. The root cause (CWE-78: Improper Neutralization of Special Elements used in an OS Command) is the use of Node.js child_process with the option shell: true, which routes the command through /bin/sh before execution. When a filePath argument contains shell metacharacters such as semicolons or backticks, the shell interprets them as command delimiters and executes the injected payload. The fix in commit b6da12c17b024a43badb1fa565720c38cf42e647 (PR #13347) switches both functions to shell: false, eliminating shell interpolation entirely, and adds a -- separator before the filePath in the git argument array to prevent the path from being misinterpreted as a git option. The PR diff and accompanying test case using the payload x;touch ${marker};
confirm the mechanism and the fix.
RemediationAI
Upgrade to umi 4.6.64, available at https://github.com/umijs/umi/releases/tag/v4.6.64, which resolves the vulnerability via commit b6da12c17b024a43badb1fa565720c38cf42e647 and pull request #13347. The fix is surgical: it removes shell: true from both getFileCreateInfo and getFileLastModifyInfo child process invocations and adds a -- argument separator before the file path, preventing both shell metacharacter injection and git option injection with no functional side effects. For teams unable to immediately upgrade, a compensating control is to restrict umi builds to internally controlled and audited project sources only, avoiding cloning or building untrusted external repositories; this does not eliminate the vulnerability but substantially reduces the attack surface. No vendor-documented feature-level workaround exists that disables the GIT File Helper without modifying source code.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today