CVE-2026-16492

MEDIUM

umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection

Title source: cna
STIX 2.1

Description

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.6.64 is sufficient to fix this issue. Patch name: b6da12c17b024a43badb1fa565720c38cf42e647. Upgrading the affected component is advised.

References (9)

Core 9
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-380948 | umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection
https://vuldb.com/vuln/380948
Signature, Permissions Required signature permissions-required
VDB-380948 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/380948/cti
Third Party Advisory third-party-advisory
CVE-2026-16492 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-16492
Third Party Advisory third-party-advisory
Submit #860128 | Node.js @umijs/utils 4.6.63 OS Command Injection
https://vuldb.com/submit/860128
Exploit exploit issue-tracking
https://github.com/umijs/umi/issues/13345
Patch issue-tracking patch
https://github.com/umijs/umi/pull/13347

Scores

CVSS v3 5.5
EPSS 0.0166
EPSS Percentile 74.3%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-77 CWE-78
Status published
Products (50)
umijs/umi 4.6.0
umijs/umi 4.6.1
umijs/umi 4.6.10
umijs/umi 4.6.11
umijs/umi 4.6.12
umijs/umi 4.6.13
umijs/umi 4.6.14
umijs/umi 4.6.15
umijs/umi 4.6.16
umijs/umi 4.6.17
... and 40 more
Published Jul 22, 2026
Tracked Since Jul 22, 2026