Umi
Monthly
OS command injection in umijs umi's GIT File Helper enables arbitrary shell command execution against developer workstations during project builds. All umi 4.6.x releases through 4.6.63 are affected via the getFileCreateInfo and getFileLastModifyInfo functions in packages/utils/src/getFileGitIno.ts, which invoke child processes with shell: true and pass unsanitized file paths directly to the shell. A public proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified, and umi 4.6.64 fully remediates the issue.
OS command injection in umijs umi's GIT File Helper enables arbitrary shell command execution against developer workstations during project builds. All umi 4.6.x releases through 4.6.63 are affected via the getFileCreateInfo and getFileLastModifyInfo functions in packages/utils/src/getFileGitIno.ts, which invoke child processes with shell: true and pass unsanitized file paths directly to the shell. A public proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified, and umi 4.6.64 fully remediates the issue.