CVE-2026-16492: umijs umi RCE Vulnerability

CVE-2026-16492 Overview

CVE-2026-16492 is an OS command injection vulnerability in the umijs umi framework affecting versions up to 4.6.63. The flaw resides in the git.getFileCreateInfo function within packages/utils/src/getFileGitIno.ts, part of the GIT File Helper component. The helper invokes git log through a shell with a user-influenced filePath argument, allowing attackers to inject shell metacharacters and execute arbitrary operating system commands. A public exploit is available. The maintainers released version 4.6.64 with patch commit b6da12c17b024a43badb1fa565720c38cf42e647 to disable shell execution and adopt safe argument passing.

Critical Impact
Attackers who control file paths processed by umi's git helper can execute arbitrary shell commands in the context of the developer or build process running umi.

Affected Products

umijs umi versions up to and including 4.6.63
Component: GIT File Helper (packages/utils/src/getFileGitIno.ts)
Fixed version: umi 4.6.64

Discovery Timeline

2026-07-22 - CVE-2026-16492 published to NVD
2026-07-22 - Last updated in NVD database
Patch commit - b6da12c17b024a43badb1fa565720c38cf42e647 released in umi v4.6.64

Technical Details for CVE-2026-16492

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-77]. The git.getFileCreateInfo function in packages/utils/src/getFileGitIno.ts spawns a git log process with shell: true and passes a filePath value as part of the command arguments. When shell execution is enabled, the underlying process invocation concatenates arguments into a shell command line, so metacharacters such as ;, |, `, or $() inside filePath are interpreted by the shell rather than treated as literal path data.

Exploitation results in arbitrary command execution with the privileges of the process running umi, which is typically a developer workstation or a continuous integration build agent. The EPSS probability is 1.664% at the 74th percentile, indicating measurable interest relative to other CVEs.

Root Cause

The root cause is unsafe use of promisifySpawn with shell: true combined with an unquoted --pretty argument and a filename passed as a positional argument. Because git argument parsing did not use the -- separator, the filePath value was also interpreted by git as an option candidate and evaluated by the shell before reaching git.

Attack Vector

An attacker supplies a crafted file path containing shell metacharacters. When umi processes that path through the GIT File Helper during builds, documentation generation, or plugin execution, the shell evaluates the injected sequence. Delivery vectors include malicious repository contents, crafted filenames added to a monitored workspace, or upstream dependencies that feed path values into the helper.

typescript

     const info = await promisifySpawn(
       'git',
       // time|name|email|since
-      ['log', '--reverse', '-1000000', "--pretty='%ad|%an|%ae|%ar'", filePath],
+      [
+        'log',
+        '--reverse',
+        '-1000000',
+        '--pretty=%ad|%an|%ae|%ar',
+        '--',
+        filePath,
+      ],
       {
         cwd: gitDirPath,
         onlyOnce: true,
-        shell: true,
+        shell: false,
       },
     );
     if (info.length && info[0]) {

Source: GitHub Commit b6da12c. The patch disables shell interpretation (shell: false), removes the shell quoting around --pretty, and inserts -- so that filePath is unambiguously treated as a pathspec.

Detection Methods for CVE-2026-16492

Indicators of Compromise

Unexpected child processes of node or umi build tooling spawning /bin/sh, bash, or cmd.exe with concatenated git log arguments.
File paths in a repository containing shell metacharacters such as ;, &&, |, `, or $( when processed by umi.
Outbound network connections initiated by developer or CI processes immediately after invoking umi build or docs commands.

Detection Strategies

Search dependency manifests (package.json, pnpm-lock.yaml, yarn.lock) for umi at versions <= 4.6.63.
Audit build and CI logs for shell invocations chained after git log --reverse -1000000 calls originating from umi.
Static analysis for Node.js spawn/exec calls with shell: true and externally influenced arguments in project code and dependencies.

Monitoring Recommendations

Alert on developer workstations and CI agents when Node.js processes spawn shells with git log and non-standard file arguments.
Monitor version control operations that create files with unusual metacharacter-laden names inside repositories built by umi.
Track process lineage on build agents to identify shell escapes originating from framework tooling.

How to Mitigate CVE-2026-16492

Immediate Actions Required

Upgrade umi to version 4.6.64 or later across all projects and CI pipelines.
Rebuild and reinstall dependency trees to ensure the patched umi utilities are resolved, not cached older copies.
Review recent CI job logs for anomalous shell activity from umi build steps prior to the upgrade.

Patch Information

The fix is committed as b6da12c17b024a43badb1fa565720c38cf42e647 and shipped in GitHub Release v4.6.64. Additional context is available in GitHub Issue #13345, GitHub Pull Request #13347, and VulDB CVE-2026-16492.

Workarounds

If upgrading immediately is not possible, avoid running umi build or documentation commands over untrusted repositories or paths.
Restrict umi execution to sandboxed CI runners with no outbound network access and least-privilege service accounts.
Validate and reject file paths containing shell metacharacters before invoking umi tooling in automation scripts.

bash

# Upgrade umi to the patched release
npm install umi@4.6.64
# or
pnpm add umi@4.6.64
# or
yarn add umi@4.6.64

# Verify resolved version
npm ls umi