---
id: CVE-2025-59831
title: >-
  git-commiters is a Node.js function module providing committers stats for
  their git repository
summary: >-
  git-commiters is a Node.js function module providing committers stats for
  their git repository. Prior to version 0.1.2, there is a command injection
  vulnerability in git-commiters. This vulnerability manifests with the
  library's primary …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-77
  - CWE-78
  - CWE-77
vendor: riceball
product: git-commiters
affected:
  - git-commiters < 0.1.2
patched:
  - git-commiters 0.1.2
published: '2025-09-25'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T20:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59831'
references:
  - url: >-
      https://github.com/snowyu/git-commiters.js/commit/7f0abfedbf506e3a61ac875d91324a8dbe756e84
    label: security-advisories@github.com
  - url: >-
      https://github.com/snowyu/git-commiters.js/security/advisories/GHSA-g38c-wxjf-xrh6
    label: security-advisories@github.com
  - url: >-
      https://github.com/snowyu/git-commiters.js/security/advisories/GHSA-g38c-wxjf-xrh6
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.0228
epssPercentile: 0.82652
ingestedAt: '2026-10-12T14:50:33.990Z'
---

## Overview

git-commiters is a Node.js function module providing committers stats for their git repository. Prior to version 0.1.2, there is a command injection vulnerability in git-commiters. This vulnerability manifests with the library's primary exported API: gitCommiters(options, callback) which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD. However, the library does not sanitize for user input or practice secure process execution API to separate commands from their arguments and as such, uncontrolled user input is concatenated into command execution. This issue has been patched in version 0.1.2.

## Affected

- `git-commiters < 0.1.2`

## Remediation

Upgrade past the affected range:

- `git-commiters 0.1.2`