CVE-2026-16492

umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection

State: Published
Severity: 5.1 Medium
Published: Jul 22, 2026
Updated: Jul 22, 2026
Reserved: Jul 21, 2026

Description

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.6.64 is sufficient to fix this issue. Patch name: b6da12c17b024a43badb1fa565720c38cf42e647. Upgrading the affected component is advised.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.5 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	5.5 Medium	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	5.2 Medium	AV:A/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-78 OS Command Injection
CWE-77 Command Injection

Affected Products

Product	Versions
umiumijs	4.6.0Affected 4.6.1Affected 4.6.2Affected 4.6.3Affected 4.6.4Affected 4.6.5Affected 4.6.6Affected 4.6.7Affected 4.6.8Affected 4.6.9Affected 4.6.10Affected 4.6.11Affected 4.6.12Affected 4.6.13Affected 4.6.14Affected 4.6.15Affected 4.6.16Affected 4.6.17Affected 4.6.18Affected 4.6.19Affected 4.6.20Affected 4.6.21Affected 4.6.22Affected 4.6.23Affected 4.6.24Affected and 40 more versions

References

VDB-380948 | umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injectionvdb-entrytechnical-description
VDB-380948 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-16492 | CVE Analysis and Reportthird-party-advisory
Submit #860128 | Node.js @umijs/utils 4.6.63 OS Command Injectionthird-party-advisory
https://github.com/umijs/umi/issues/13345exploitissue-tracking
https://github.com/umijs/umi/pull/13347issue-trackingpatch
https://github.com/umijs/umi/commit/b6da12c17b024a43badb1fa565720c38cf42e647patch
https://github.com/umijs/umi/releases/tag/v4.6.64patch
https://github.com/umijs/umi/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.