CVE-2021-3190

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jan 26, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-319005.3In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host.CVE-2021-319017.5In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.CVE-2021-319027.5In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly.CVE-2021-319036.1In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.CVE-2021-319046.1In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.CVE-2021-319057.5In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible.CVE-2021-319062.7In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file.CVE-2021-319075.3In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.CVE-2021-319085.4In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages.CVE-2021-319099.8In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.CVE-2021-31918.8Idelji Web ViewPoint Suite, as used in conjunction with HPE NonStop, allows Remote Unauthorized Access for T0320L01^ABY and T0320L01^ACD, T0CVE-2021-319107.5In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.
CVE-2021-3190: Critical severity, CVSS 9.8 | Vulnix