The degit package versions prior to 2.8.6 and between 3.0.0 and 3.3.1 contain a command injection vulnerability (CVE-2026-11572) due to insufficient sanitization of user-supplied input in git shell commands executed by the exec() method within the _cloneWithGit() and fetchRefs() functions. This flaw allows attackers to execute arbitrary OS commands as the process user by crafting malicious git repository names. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. There is no vendor advisory or patch information currently available, and the vulnerability is not known to be exploited in the wild.

Successful exploitation enables an unauthenticated attacker to execute arbitrary operating system commands with the privileges of the degit process user. This can lead to system compromise, data theft, or further attacks depending on the environment where degit is used. The high CVSS score reflects the network attack vector, low complexity, no privileges required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using affected versions of degit with untrusted input, or implement input validation and sanitization controls externally. Monitor official degit repositories and security advisories for updates and patches addressing this vulnerability.