RCE in Riceball Git-Commiters
CVE-2025-59831
git-commiters is a Node.js function module providing committers stats for their git repository. Prior to version 0.1.2, there is a command injection vulnerability in git-commiters. This vulnerability manifests with the library's primary exported API: gitCommiters(options, callback) which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD. However, the library does not sanitize for user input or practice secure process execution API to separate commands from their arguments and as such, uncontrolled user input is concatenated into command execution. This issue has been patched in version 0.1.2.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.023 (81.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Riceball Git-commiters
- Snowyu Git-commiters.js — versions < 0.1.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-59831?
- CVE-2025-59831 is a high-severity vulnerability in Riceball Git-Commiters, classified under Command Injection. CVSS score: 8.8/10. Published 2025-09-25.
- How severe is CVE-2025-59831?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2025-59831 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.