CVE-2026-16492CWE-77CWE-78

umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection

Medium · published July 22, 2026

CVSS v4.0
5.1
EPSS
4%
Percentile
90.3
In the wild
Unconfirmed
What it is

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.6.64 is sufficient to fix this issue. Patch name: b6da12c17b024a43badb1fa565720c38cf42e647. Upgrading the affected component is advised.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.03912 · 90.3th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-22T00:45Z
EPSS history
Timeline
  • 22 JUL 00:45Z
    umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection
    cvelistv5