Security readout for executives and security teams
Plain-English summary
CVE-2021-32673 is a high-severity command execution flaw in reg-keygen-git-hash-plugin, used with reg-suit visual regression workflows. Versions through 0.10.15 are affected. If present in build or CI tooling, it could let an attacker run arbitrary commands in that environment. Upgrade to 0.10.16 or later.
Executive priority
Prioritize remediation for repositories where this plugin runs in CI or build automation. The fix is a dependency upgrade, but the potential impact includes command execution in trusted automation, which can expose credentials and deployment paths.
Technical view
The issue is classified as CWE-94 and scored CVSS 8.8. Public sources state reg-keygen-git-hash-plugin through 0.10.15 allows remote arbitrary command execution. The official remediation is version 0.10.16 or later. The source bundle does not provide detailed exploit mechanics.
Likely exposure
Likely exposure is JavaScript projects using reg-suit with reg-keygen-git-hash-plugin versions 0.10.15 or earlier, especially in CI or visual regression pipelines. Exposure should be confirmed from package manifests, lockfiles, and generated dependency inventories.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. Treat exploitation status as unconfirmed. Business risk is higher when the plugin runs in automated environments with repository tokens, cloud credentials, deployment permissions, or access to sensitive build artifacts.
Researcher notes
Evidence supports affected versions and the fixed release, but the bundle does not include exploit details, exploitation telemetry, or environmental prerequisites beyond the CVSS vector and advisory text. Avoid assuming internet-facing exposure without confirming how the plugin is invoked.
Mitigation direction
- Upgrade reg-keygen-git-hash-plugin to 0.10.16 or later.
- Regenerate and review lockfiles after the dependency update.
- Check vendor advisory and release notes for any additional guidance.
- Limit CI secrets available to visual regression jobs.
- Review recent CI runs for unexpected command execution indicators.
Validation and detection
- Search package manifests and lockfiles for reg-keygen-git-hash-plugin.
- Confirm installed versions are 0.10.16 or later.
- Verify reg-suit workflows no longer resolve vulnerable plugin versions.
- Run the project’s unit and CI tests after upgrading.
- Review dependency scan output for CVE-2021-32673 closure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-32673 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L2.85.3Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/reg-viz/reg-suit/security/advisories/GHSA-49q3-8867-5wmpCVE reference · x_refsource_CONFIRM
- https://github.com/reg-viz/reg-suit/commit/f84ad9c7a22144d6c147dc175c52756c0f444d87CVE reference · x_refsource_MISC
- https://github.com/reg-viz/reg-suit/releases/tag/v0.10.16CVE reference · x_refsource_MISC
- https://www.npmjs.com/package/reg-keygen-git-hash-pluginCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.