{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.4.12"}],"component":"ggit","cve_ids":["CVE-2024-21532"],"ecosystem":"npm","epss":0.01289,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-62cx-5xj4-wfm4","id":"tcs_01M5KF55J7SS08QG7GRT0Q2A0F","modified_at":"2024-10-08T15:12:10.837137Z","published_at":"2024-10-08T06:30:47Z","references":["https://osv.dev/vulnerability/GHSA-62cx-5xj4-wfm4","https://nvd.nist.gov/vuln/detail/CVE-2024-21532","https://gist.github.com/lirantal/d8f87b366d2078e6118ab7bf2b005f02","https://github.com/bahmutov/ggit","https://security.snyk.io/vuln/SNYK-JS-GGIT-5731320"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-62cx-5xj4-wfm4","url":"https://osv.dev/vulnerability/GHSA-62cx-5xj4-wfm4"}],"summary":"ggit is vulnerable to Command Injection via the fetchTags(branch) API"}