{"action":"Upgrade degit to 2.8.6 or later.","affected":[{"fixed":"2.8.6","introduced":"0"},{"fixed":"3.3.1","introduced":"3.0.0"}],"component":"degit","cve_ids":["CVE-2026-11572"],"ecosystem":"npm","epss":0.01043,"exploited":false,"fixed_versions":["2.8.6","3.3.1"],"ghsa_id":"GHSA-77c7-pq4r-6mcq","id":"tcs_01M5KF93YKSNQ09PD39BJ496GK","modified_at":"2026-07-30T18:56:41.887059Z","published_at":"2026-06-09T06:31:59Z","references":["https://osv.dev/vulnerability/GHSA-77c7-pq4r-6mcq","https://nvd.nist.gov/vuln/detail/CVE-2026-11572","https://github.com/Rich-Harris/degit/commit/4ac99e4a4c3f53ca3b5c997bcd7542742ad0c443","https://github.com/Rich-Harris/degit/commit/d55bfd7cea79c0b387f69ec8477b6c34abf9f226","https://gist.github.com/badp3te/cf22a939eedbd3d8ade9123827d61639","https://github.com/Rich-Harris/degit","https://security.snyk.io/vuln/SNYK-JS-DEGIT-17116207"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-77c7-pq4r-6mcq","url":"https://osv.dev/vulnerability/GHSA-77c7-pq4r-6mcq"}],"summary":"degit has a Command Injection issue"}