Medium severity5.3NVD Advisory· Published Oct 1, 2024· Updated Apr 15, 2026

CVE-2024-21531

Description

All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the process variable of the gitShallowClone function.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
git-shallow-clonenpm	<= 0.0.2	—

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-qwrq-vxvw-537rghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-21531ghsaADVISORY
github.com/10uei011/git-shallow-clone/blob/master/index.jsghsaWEB
security.snyk.io/vuln/SNYK-JS-GITSHALLOWCLONE-3253853nvdWEB
github.com/10uei011/git-shallow-clone/blob/master/index.js%23L27nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000