CVE-2026-16492 | umijs umi up to 4.6.63 GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection (Issue 13345)

July 21, 2026 Yanac

A vulnerability was found in umijs umi up to 4.6.63. It has been rated as critical. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection.

This vulnerability is tracked as CVE-2026-16492. The attack is only possible within the local network. Moreover, an exploit is present.

Upgrading the affected component is advised.VulDB Recent EntriesRead More