CVE-2026-11572: Versions of the package degit before 2

Synopsis

Command injection vulnerability in the degit package (versions before 2.8.6 and 3.0.0 through before 3.3.1) allows a remote attacker to execute arbitrary operating system commands on the host running degit. The vulnerability is reachable over the network and requires no authentication, but does require the victim to interact with a specially crafted git repository name passed to the tool. Successful exploitation gives the attacker full command execution as the process user, enabling data theft, file modification, or service disruption. Patched-image rebuilds at versions 2.8.6 and 3.3.1 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the service or trigger degit over the network, supplying a crafted repository name to the invoked git shell command.

• AuthenticationNot required

  No credentials or account are needed; the attacker can supply the malicious input without authenticating to any service.

• Victim interactionRequired

  A user must interact with the attacker-controlled input, for example by running degit against a specially crafted repository name provided or referenced by the attacker.

• Attack complexityDetail

  Exploit reliability is high and no special environmental conditions, race conditions, or memory layout assumptions are required to trigger the injection.

Blast Radius

• Attacker executes arbitrary OS commands as the process user running degit, gaining a foothold on the build host or CI runner.
• Attacker reads sensitive files accessible to the process user, including source code, credentials, and environment variables stored on disk or in the environment.
• Attacker modifies or deletes files on the host, tampering with build artifacts, configuration files, or dependency caches.
• Attacker disrupts the affected build or tooling service, causing pipeline failures or corrupting outputs delivered downstream.