CVE-2026-11572: degit Package RCE Vulnerability

CVE-2026-11572 Overview

CVE-2026-11572 is a command injection vulnerability in the degit Node.js package, a tool used to clone Git repositories without history. The flaw exists in the _cloneWithGit() and fetchRefs() functions, which pass user-supplied repository names directly to exec() without sanitization. An attacker who controls or supplies a crafted Git repository name can execute arbitrary operating system commands under the privileges of the Node.js process. Affected versions include degit releases before 2.8.6 and 3.0.0 through versions before 3.3.1. The vulnerability maps to [CWE-78] (OS Command Injection) and [CWE-77] (Command Injection).

Critical Impact
Successful exploitation results in arbitrary OS command execution on systems running vulnerable degit versions, enabling code execution, data theft, and lateral movement.

Affected Products

degit versions prior to 2.8.6
degit versions 3.0.0 through versions prior to 3.3.1
Node.js applications and CI/CD pipelines that invoke degit with attacker-influenced repository identifiers

Discovery Timeline

2026-06-09 - CVE-2026-11572 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11572

Vulnerability Analysis

The degit utility clones Git repositories by shelling out to the git binary through Node.js's child_process.exec(). When a user passes a repository identifier on the command line or through an API call, the string is interpolated into a shell command without escaping or validation. Because exec() spawns a shell, any shell metacharacters embedded in the repository name are interpreted by /bin/sh or cmd.exe. The unsanitized inputs flow into both _cloneWithGit() and fetchRefs(), broadening the attack surface across clone and reference-resolution code paths.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. The vulnerable functions construct shell command strings using template literals that include the user-supplied user/name repository identifier. Characters such as ;, &&, |, backticks, and $() are passed through unchanged to the shell, allowing arbitrary command chaining.

Attack Vector

An attacker supplies a crafted repository name containing shell metacharacters. When the vulnerable application calls degit('user/name; malicious-command'), the shell parses and executes the appended commands as the process user. Exploitation requires user interaction in that a developer, CI job, or script must initiate the degit operation with the attacker-controlled identifier. A public proof-of-concept is available via a GitHub Gist PoC.

typescript

// Patch excerpt from src/index.ts — fix: harden git-mode remote handling (#429)
 const domain = provider.domain;
 const url = `https://${domain}/${user}/${name}`;
-const ssh = `git@${domain}:${user}/${name}`;
+const ssh = `ssh://git@${domain}/${user}/${name}`;

 const mode = 'tar';

The patch rewrites the SSH remote from the colon-separated git@host:user/name form to the ssh:// URL form. This change prevents metacharacters in user and name from being interpreted as shell tokens during git clone invocation. Source: GitHub Commit d55bfd7.

Detection Methods for CVE-2026-11572

Indicators of Compromise

Unexpected child processes spawned from Node.js processes that load the degit module, particularly shells (sh, bash, cmd.exe) executing non-git commands.
Outbound network connections initiated by Node.js processes immediately after a degit clone operation.
Presence of shell metacharacters (;, &&, |, `, $() in repository identifiers recorded in CI/CD logs or application telemetry.
degit package versions earlier than 2.8.6 or in the 3.0.0–3.3.0 range listed in package-lock.json or bun.lock manifests.

Detection Strategies

Scan dependency manifests across repositories and build agents for vulnerable degit versions using SCA tooling referencing the Snyk Vulnerability Report.
Monitor process-creation telemetry for node parents spawning shells that execute commands unrelated to git clone, git fetch, or tar.
Inspect CI/CD job inputs and webhook payloads for repository names containing shell metacharacters before they reach degit.

Monitoring Recommendations

Forward endpoint process and command-line telemetry to a centralized data lake and alert on Node.js child processes that deviate from baseline git-only invocations.
Enable file integrity monitoring on developer workstations and build hosts to flag unexpected writes following scaffolding operations.
Audit npm and registry pulls of degit and alert when versions outside the patched ranges are installed.

How to Mitigate CVE-2026-11572

Immediate Actions Required

Upgrade degit to version 2.8.6 or later on the 2.x branch, or to version 3.3.1 or later on the 3.x branch.
Audit all repositories, container images, and build agents for vulnerable degit versions and rebuild artifacts after patching.
Restrict the source of repository identifiers passed to degit so they cannot be influenced by untrusted users or webhook payloads.
Review CI/CD and developer machine logs for prior invocations of degit with suspicious repository strings.

Patch Information

The maintainers addressed the issue across multiple commits. Commit 4ac99e4 introduces eslint-plugin-security rules including security/detect-child-process to catch unsafe exec() patterns. Commit d55bfd7 hardens the SSH remote construction in src/index.ts to use the ssh:// URL form, preventing shell interpretation of repository identifiers. Fixed versions are 2.8.6 and 3.3.1.

Workarounds

If immediate upgrade is not possible, validate repository identifiers against a strict allowlist regex such as ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+(#[A-Za-z0-9._/-]+)?$ before invoking degit.
Avoid passing untrusted input to degit from web forms, webhooks, or chat bots; require human review of scaffolding requests.
Run degit-based tooling under a least-privilege account with no write access to sensitive directories or credentials.

bash

# Upgrade degit to a patched release
npm install degit@^3.3.1
# or for the 2.x line
npm install degit@^2.8.6

# Verify installed version
npm ls degit