CVE-2021-23326

MEDIUM

@graphql-tools/git-loader <6.2.6 - Command Injection

Title source: llm
STIX 2.1

Description

This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.

References (5)

Core 5
Core References
Product, Third Party Advisory x_refsource_misc
https://snyk.io/vuln/SNYK-JS-GRAPHQLTOOLSGITLOADER-1062543
Patch, Third Party Advisory x_refsource_misc
https://github.com/ardatan/graphql-tools/pull/2470
Third Party Advisory x_refsource_misc
https://advisory.checkmarx.net/advisory/CX-2020-4300

Scores

CVSS v3 6.3
EPSS 0.0281
EPSS Percentile 84.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Details

CWE
CWE-78
Status published
Products (2)
graphql-tools/git-loader 0 - 6.2.6npm
the-guild/graphql-tools < 6.2.6
Published Jan 20, 2021
Tracked Since Feb 18, 2026