Duplicate Advisory: Command Injection in fs-git

HIGHCVE-2017-16087 · GHSA-qr32-j4j6-3m7r · Published 29/05/2019 · updated 10/09/2026

In short

Package	Affected versions	Patched versions
fs-git npm	`< 1.0.2`	`1.0.2`

This advisory has been withdrawn because it is a duplicate of GHSA-wp3j-gv53-4pg8. This link is maintained to preserve external references.

Affected versions of fs-git do not sanitize strings passed into the buildCommand method, resulting in arbitrary code execution.

Update to version 1.0.2 or later.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.