Security readout for executives and security teams
Plain-English summary
CVE-2021-23412 affects the npm package gitlogplus. If an application lets untrusted data reach gitlogplus options, that data may be appended to an operating-system command. Successful exploitation could let an attacker run commands with the application’s privileges.
Executive priority
Treat this as high priority where gitlogplus is present in production, CI/CD, or automation contexts. Business urgency depends on whether untrusted users can influence options and what privileges the process holds.
Technical view
All versions of gitlogplus are reported vulnerable to command injection in main functionality because option attributes are appended to the executed command without sanitization. The CVSS 3.1 score is 8.1, reflecting network reachability, no privileges or user interaction, high impact, and high attack complexity.
Likely exposure
Exposure is most likely in Node.js applications, CI jobs, internal tooling, or services that depend on gitlogplus and pass user-controlled or externally influenced option attributes into it.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. The issue is public through CVE, Snyk, HackerOne, and npm references, so defenders should assume capable researchers can understand the weakness.
Researcher notes
Evidence supports command injection through unsanitized option attributes in all gitlogplus versions. The bundle does not provide a fixed version, confirmed exploit activity, or vendor mitigation details, so validation should focus on dependency presence and data-flow reachability.
Mitigation direction
- Inventory applications and build tooling for direct or transitive gitlogplus use.
- Check npm and vendor advisories for current maintenance or replacement guidance.
- Remove or replace gitlogplus where untrusted input can reach its options.
- Restrict option values to trusted, validated internal inputs only.
- Prioritize affected internet-facing services and automation running with sensitive privileges.
Validation and detection
- Search dependency manifests and lockfiles for gitlogplus.
- Review code paths passing request, webhook, CI, or repository metadata into gitlogplus options.
- Confirm whether any affected process runs with production secrets or deployment privileges.
- Check runtime and CI logs for unexpected command execution indicators.
- Document whether gitlogplus remains present, removed, or isolated from untrusted input.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-23412 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://snyk.io/vuln/SNYK-JS-GITLOGPLUS-1315832CVE reference · x_refsource_MISC
- https://hackerone.com/reports/808942CVE reference · x_refsource_MISC
- https://www.npmjs.com/package/gitlogplusCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.