CVE-2021-32673

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and including 0.10.15 allow remote attackers to execute of arbitrary commands. Upgrade to version 0.10.16 or later to resolve this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-78

Affected software

Vendor	Product	Versions
reg-viz	reg-suit	< 0.10.16

References

https://github.com/reg-viz/reg-suit/commit/f84ad9c7a22144d6c147dc175c52756c0f444d87Patch, Third Party Advisory
https://github.com/reg-viz/reg-suit/releases/tag/v0.10.16Release Notes, Third Party Advisory
https://github.com/reg-viz/reg-suit/security/advisories/GHSA-49q3-8867-5wmpThird Party Advisory
https://www.npmjs.com/package/reg-keygen-git-hash-pluginProduct, Third Party Advisory
https://github.com/reg-viz/reg-suit/commit/f84ad9c7a22144d6c147dc175c52756c0f444d87Patch, Third Party Advisory
https://github.com/reg-viz/reg-suit/releases/tag/v0.10.16Release Notes, Third Party Advisory
https://github.com/reg-viz/reg-suit/security/advisories/GHSA-49q3-8867-5wmpThird Party Advisory
https://www.npmjs.com/package/reg-keygen-git-hash-pluginProduct, Third Party Advisory

Timeline

Published: Jun 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-326748.8Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/securit CVE-2021-326757.5Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis al CVE-2021-326766.5Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0 CVE-2021-326778.1FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that u CVE-2021-326785.3Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not app CVE-2021-326798.8Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, filenames where not es CVE-2021-326803.3Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11, and 21.0.3, Nextcloud Server audit CVE-2021-326815.4Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, ve CVE-2021-326829.8elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. Thes CVE-2021-326836.1wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to versio CVE-2021-326845.5magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Ma CVE-2021-326859.8tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), use