Umijs Umi <=4.6.63: GIT File Helper OS command injection
CVE-2026-16492 Published on July 22, 2026
umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection
A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.6.64 is sufficient to fix this issue. Patch name: b6da12c17b024a43badb1fa565720c38cf42e647. Upgrading the affected component is advised.
Timeline
Advisory disclosed
VulDB entry created
VulDB entry last update
Weakness Types
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2026-16492 has been classified to as a Shell injection vulnerability or weakness.
What is a Command Injection Vulnerability?
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVE-2026-16492 has been classified to as a Command Injection vulnerability or weakness.
Products Associated with CVE-2026-16492
Want to know whenever a new CVE is published for Umijs Umi? stack.watch will email you.
Affected Versions
umijs umi:- Version 4.6.0 is affected.
- Version 4.6.1 is affected.
- Version 4.6.2 is affected.
- Version 4.6.3 is affected.
- Version 4.6.4 is affected.
- Version 4.6.5 is affected.
- Version 4.6.6 is affected.
- Version 4.6.7 is affected.
- Version 4.6.8 is affected.
- Version 4.6.9 is affected.
- Version 4.6.10 is affected.
- Version 4.6.11 is affected.
- Version 4.6.12 is affected.
- Version 4.6.13 is affected.
- Version 4.6.14 is affected.
- Version 4.6.15 is affected.
- Version 4.6.16 is affected.
- Version 4.6.17 is affected.
- Version 4.6.18 is affected.
- Version 4.6.19 is affected.
- Version 4.6.20 is affected.
- Version 4.6.21 is affected.
- Version 4.6.22 is affected.
- Version 4.6.23 is affected.
- Version 4.6.24 is affected.
- Version 4.6.25 is affected.
- Version 4.6.26 is affected.
- Version 4.6.27 is affected.
- Version 4.6.28 is affected.
- Version 4.6.29 is affected.
- Version 4.6.30 is affected.
- Version 4.6.31 is affected.
- Version 4.6.32 is affected.
- Version 4.6.33 is affected.
- Version 4.6.34 is affected.
- Version 4.6.35 is affected.
- Version 4.6.36 is affected.
- Version 4.6.37 is affected.
- Version 4.6.38 is affected.
- Version 4.6.39 is affected.
- Version 4.6.40 is affected.
- Version 4.6.41 is affected.
- Version 4.6.42 is affected.
- Version 4.6.43 is affected.
- Version 4.6.44 is affected.
- Version 4.6.45 is affected.
- Version 4.6.46 is affected.
- Version 4.6.47 is affected.
- Version 4.6.48 is affected.
- Version 4.6.49 is affected.
- Version 4.6.50 is affected.
- Version 4.6.51 is affected.
- Version 4.6.52 is affected.
- Version 4.6.53 is affected.
- Version 4.6.54 is affected.
- Version 4.6.55 is affected.
- Version 4.6.56 is affected.
- Version 4.6.57 is affected.
- Version 4.6.58 is affected.
- Version 4.6.59 is affected.
- Version 4.6.60 is affected.
- Version 4.6.61 is affected.
- Version 4.6.62 is affected.
- Version 4.6.63 is affected.
- Version 4.6.64 is unaffected.