CVE-2020-7619: Command injection in get-git-data

May 10, 2021 (updated July 6, 2026)

get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data.

References

github.com/advisories/GHSA-wj6h-7chw-x4h2
github.com/chardos/get-git-data/blob/master/index.js
nvd.nist.gov/vuln/detail/CVE-2020-7619
snyk.io/vuln/SNYK-JS-GETGITDATA-564222

Code Behaviors & Features

Detect and mitigate CVE-2020-7619 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →