Threats affecting pkg:npm/degit

The degit package contains a command injection vulnerability in versions before 2.8.6 and from 3.0.0 up to 3.3.1. This vulnerability is due to improper sanitization of user input used in git shell commands executed via exec(), allowing attackers to execute arbitrary OS commands with the privileges of the running process. It has a high severity rating with a CVSS score of 8.7.