Dashboard / CVE-2026-16492

CVE-2026-16492

LOW
INFO Priority: 0.08 BB Relevance: 40/100
Published: 2026-07-22 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent Low Complexity No Interaction

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: Low
VI: Low
VA: Low

Description

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.6.64 is sufficient to fix this issue. Patch name: b6da12c17b024a43badb1fa565720c38cf42e647. Upgrading the affected component is advised.

Weakness Classification (2)

References & Advisories (9)

Bug Bounty Relevance

40 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

2.0 / 10.0 v4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

3.91%
Raw Score 0.039120
Percentile 90.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.03912
2026-10-28
0.03912

Intelligence Sources

nvd ref →

External Links