The vulnerability arises in the GIT File Helper of umijs:umi, specifically the getFileCreateInfo function defined in packages/utils/src/getFileGitIno.ts. The function fails to properly validate or sanitize its inputs before passing them to the operating system for execution, allowing an attacker to inject arbitrary OS commands. Because the commands run in the context of the application, successful exploitation would let an attacker execute arbitrary code, potentially leading to full compromise of the host system, impacting confidentiality, integrity, and availability.

This flaw affects all versions of umijs:umi up to and including 4.6.63. The vulnerable code is part of the default distribution supplied by the umijs CNA. The fix is included in release 4.6.64; therefore any installation running a version older than 4.6.64 is vulnerable.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of 2% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector involves an external or user‑supplied value that is fed to git.getFileCreateInfo; an attacker who can influence that input—such as through a compromised developer workflow or by gaining privileged access to the application environment—could trigger the injection. No publicly available exploit code beyond a proof‑of‑concept exists at this time.