CVE-2026-11572 is a command injection vulnerability in the degit package affecting versions prior to 2.8.6 and versions from 3.0.0 through 3.3.1. The issue arises from insufficient sanitization of user-supplied input used in git shell commands executed via the exec() method in certain functions. An attacker can exploit this by providing a specially crafted git repository name, leading to arbitrary OS command execution with the permissions of the degit process. This vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS 4.0 base score is 8.7, indicating high severity. No official patch or remediation guidance is currently documented, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the degit process. This can lead to full system compromise depending on the privileges of the running process. The vulnerability affects the integrity and confidentiality of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions of degit or restrict usage to trusted inputs only. Monitor vendor channels for updates regarding patches or official mitigations.