CVE-2021-44684

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is directly used by the exec function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/dwisiswant0/advisory/issues/5Exploit, Issue Tracking, Third Party Advisory
https://github.com/naholyr/github-todos/issues/34Issue Tracking, Third Party Advisory
https://github.com/dwisiswant0/advisory/issues/5Exploit, Issue Tracking, Third Party Advisory
https://github.com/naholyr/github-todos/issues/34Issue Tracking, Third Party Advisory

Timeline

Published: Dec 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-446859.8Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it a CVE-2021-446867.5calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_ru CVE-2021-44698.7Denver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentica CVE-2021-446925.3BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a CVE-2021-446934.9Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni CVE-2021-446945.5Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni CVE-2021-446954.9Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni CVE-2021-446965.5Adobe Prelude version 22.1.1 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive mem CVE-2021-446973.3Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to dis CVE-2021-446983.3Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to dis CVE-2021-446993.3Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to dis CVE-2021-44709.3TG8 Firewall contains a pre-authentication remote code execution vulnerability in the runphpcmd.php endpoint. The syscmd POST parameter is p