{"id":"CVE-2021-23326","details":"This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.","aliases":["GHSA-vhhw-xjvf-wprr","SNYK-JS-GRAPHQLTOOLSGITLOADER-1062543"],"modified":"2026-07-09T12:33:05.767932Z","published":"2021-01-20T13:15:12.893Z","references":[{"type":"ADVISORY","url":"https://advisory.checkmarx.net/advisory/CX-2020-4300"},{"type":"ADVISORY","url":"https://github.com/ardatan/graphql-tools/releases/tag/%40graphql-tools%2Fgit-loader%406.2.6"},{"type":"ADVISORY","url":"https://snyk.io/vuln/SNYK-JS-GRAPHQLTOOLSGITLOADER-1062543"},{"type":"FIX","url":"https://github.com/ardatan/graphql-tools/commit/6a966beee8ca8b2f4adfe93318b96e4a5c501eac"},{"type":"FIX","url":"https://github.com/ardatan/graphql-tools/pull/2470"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ardatan/graphql-tools","events":[{"introduced":"0"},{"fixed":"69d8499f0fff1bb9b8fd9c2149788ed9f5578504"},{"fixed":"6a966beee8ca8b2f4adfe93318b96e4a5c501eac"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:the-guild:graphql-tools:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"6.2.6"}]}}],"versions":["@graphql-tools/utils@7.2.4","@graphql-tools/stitching-directives@1.1.2","@graphql-tools/stitch@7.1.8","@graphql-tools/stitch@7.1.7","@graphql-tools/graphql-tag-pluck@6.4.0","@graphql-tools/stitching-directives@1.1.1","@graphql-tools/utils@7.2.3","@graphql-tools/utils@7.2.2","@graphql-tools/wrap@7.0.5","@graphql-tools/utils@7.2.1","@graphql-tools/utils@7.2.0","@graphql-tools/stitching-directives@1.1.0","@graphql-tools/stitch@7.1.6","@graphql-tools/utils@7.1.6","@graphql-tools/stitch@7.1.5","@graphql-tools/delegate@7.0.8","@graphql-tools/utils@7.1.5","@graphql-tools/url-loader@6.7.1","@graphql-tools/url-loader@6.7.0","@graphql-tools/url-loader@6.6.0","@graphql-tools/wrap@7.0.4","@graphql-tools/utils@7.1.4","@graphql-tools/url-loader@6.5.0","@graphql-tools/utils@7.1.3","@graphql-tools/wrap@7.0.3","@graphql-tools/utils@7.1.2","@graphql-tools/stitching-directives@1.0.0","@graphql-tools/stitch@7.1.4","@graphql-tools/schema@7.1.2","@graphql-tools/stitch@7.1.2","@graphql-tools/wrap@7.0.2","@graphql-tools/delegate@7.0.7","@graphql-tools/batch-delegate@7.0.1","@graphql-tools/stitch@7.1.1","@graphql-tools/merge@6.2.6","@graphql-tools/delegate@7.0.6","@graphql-tools/utils@7.1.0","@graphql-tools/stitch@7.1.0","@graphql-tools/schema@7.1.0","@graphql-tools/relay-operation-optimizer@6.3.0","graphql-tools@7.0.2","@graphql-tools/webpack-loader@6.3.1","@graphql-tools/optimize@1.0.1","@graphql-tools/webpack-loader@6.3.0","@graphql-tools/optimize@1.0.0","@graphql-tools/prisma-loader@6.2.7","@graphql-tools/load-files@6.2.5","@graphql-tools/json-file-loader@6.2.6","@graphql-tools/import@6.2.5","@graphql-tools/graphql-file-loader@6.2.6","@graphql-tools/code-file-loader@6.2.6","@graphql-tools/prisma-loader@6.2.6","@graphql-tools/stitch@7.0.4","@graphql-tools/delegate@7.0.5","@graphql-tools/delegate@7.0.4","@graphql-tools/url-loader@6.4.0","@graphql-tools/utils@7.0.2","@graphql-tools/links@7.0.3","@graphql-tools/delegate@7.0.3","@graphql-tools/stitch@7.0.3","@graphql-tools/links@7.0.2","@graphql-tools/delegate@7.0.2","@graphql-tools/stitch@7.0.2","@graphql-tools/links@7.0.1","@graphql-tools/wrap@7.0.1","@graphql-tools/graphql-tag-pluck@6.3.0","graphql-tools@7.0.1","@graphql-tools/utils@7.0.1","@graphql-tools/url-loader@6.3.2","@graphql-tools/links@7.0.0","@graphql-tools/delegate@7.0.1","graphql-tools@7.0.0","@graphql-tools/stitch@7.0.1","@graphql-tools/batch-delegate@7.0.0","graphql-tools@6.2.6","@graphql-tools/batch-delegate@6.2.6","graphql-tools@6.2.5","@graphql-tools/wrap@7.0.0","@graphql-tools/utils@7.0.0","@graphql-tools/url-loader@6.3.1","@graphql-tools/stitch@7.0.0","@graphql-tools/schema@7.0.0","@graphql-tools/resolvers-composition@6.2.5","@graphql-tools/relay-operation-optimizer@6.2.5","@graphql-tools/prisma-loader@6.2.5","@graphql-tools/module-loader@6.2.5","@graphql-tools/mock@7.0.0","@graphql-tools/merge@6.2.5","@graphql-tools/load@6.2.5","@graphql-tools/links@6.2.5","@graphql-tools/json-file-loader@6.2.5","@graphql-tools/graphql-tag-pluck@6.2.6","@graphql-tools/graphql-file-loader@6.2.5","@graphql-tools/github-loader@6.2.5","@graphql-tools/git-loader@6.2.5","@graphql-tools/delegate@7.0.0","@graphql-tools/code-file-loader@6.2.5","@graphql-tools/batch-execute@7.0.0","@graphql-tools/batch-delegate@6.2.5","@graphql-tools/apollo-engine-loader@6.2.5","@graphql-tools/url-loader@6.3.0","@graphql-tools/graphql-tag-pluck@6.2.5","graphql-tools@6.2.4","@graphql-tools/wrap@6.2.4","@graphql-tools/webpack-loader@6.2.4","@graphql-tools/webpack-loader-runtime@6.2.4","@graphql-tools/utils@6.2.4","@graphql-tools/url-loader@6.2.4","@graphql-tools/stitch@6.2.4","@graphql-tools/schema@6.2.4","@graphql-tools/resolvers-composition@6.2.4","@graphql-tools/relay-operation-optimizer@6.2.4","@graphql-tools/prisma-loader@6.2.4","@graphql-tools/node-require@6.2.4","@graphql-tools/module-loader@6.2.4","@graphql-tools/mock@6.2.4","@graphql-tools/merge@6.2.4","@graphql-tools/load@6.2.4","@graphql-tools/load-files@6.2.4","@graphql-tools/links@6.2.4","@graphql-tools/json-file-loader@6.2.4","@graphql-tools/import@6.2.4","@graphql-tools/graphql-tag-pluck@6.2.4","@graphql-tools/graphql-file-loader@6.2.4","@graphql-tools/github-loader@6.2.4","@graphql-tools/git-loader@6.2.4","@graphql-tools/delegate@6.2.4","@graphql-tools/code-file-loader@6.2.4","@graphql-tools/batch-delegate@6.2.4","@graphql-tools/apollo-engine-loader@6.2.4","v6.2.3","v6.2.2","v6.2.1","v6.2.0","v6.1.0","v6.0.18","v6.0.17","v6.0.16","v6.0.15","v6.0.14","v6.0.13","v6.0.12","v6.0.11","v6.0.10","v6.0.9","v6.0.8","v6.0.7","v6.0.5","v6.0.4","v6.0.3","v6.0.2","v6.0.1","v6.0.0","v5.0.0","v4.0.7","v4.0.6","v4.0.5","v4.0.4","v4.0.3","v4.0.2","4.0.0","v3.1.1","v3.1.0","v3.0.5","v3.0.2","v3.0.1","v3.0.0","v3.0.0-beta.0","v2.24.0","v2.23.1","v2.23.0","v2.14.0","2.13.0","v2.12.0","v2.10.0","v2.6.1","v2.6.0","v2.5.1","v2.2.0","v1.2.3","v1.2.2","1.2.1","v1.2.0","v0.6.2","v0.6.0","v0.4.2","v0.4.0","v0.3.14","v0.3.13","v0.3.12","v0.3.11","v0.3.10","v0.3.9","v0.3.6","v0.3.5","v0.3.3","v0.3.2","v0.3.1","v0.2.7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23326.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}