CVE-2021-44685

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/dwisiswant0/advisory/issues/3Exploit, Issue Tracking, Third Party Advisory
https://github.com/jlord/git-it-electron/releasesRelease Notes, Third Party Advisory
https://github.com/dwisiswant0/advisory/issues/3Exploit, Issue Tracking, Third Party Advisory
https://github.com/jlord/git-it-electron/releasesRelease Notes, Third Party Advisory

Timeline

Published: Dec 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-446867.5calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_ru CVE-2021-44698.7Denver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentica CVE-2021-446925.3BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a CVE-2021-446934.9Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni CVE-2021-446945.5Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni CVE-2021-446954.9Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni CVE-2021-446965.5Adobe Prelude version 22.1.1 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive mem CVE-2021-446973.3Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to dis CVE-2021-446983.3Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to dis CVE-2021-446993.3Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to dis CVE-2021-44709.3TG8 Firewall contains a pre-authentication remote code execution vulnerability in the runphpcmd.php endpoint. The syscmd POST parameter is p CVE-2021-447005.5Adobe Illustrator versions 25.4.2 (and earlier) and 26.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead