A function in the GitList application can be manipulated to inject arbitrary operating system commands. The injection occurs in the getDefaultBranch routine of the Git Command Line component when unsanitized input is passed to a shell. An attacker who can trigger this routine remotely can thus execute arbitrary commands on the host server, potentially compromising confidentiality, integrity, and availability of the system. This class of vulnerability is explicitly listed under CWE‑77 and CWE‑78. The CVSS score of 6.9 indicates moderate severity, and the exploit has been publicly disclosed and may be used in the wild.

The flaw affects the GitList project released by the maintainer klaussilveira, specifically versions 2.0.0 and earlier. The component is identified in the source as src/SCM/System/Git/CommandLine.php. Versions 3.0.0‑beta and later incorporate a patch (commit 88cf2866083d5f7c20d9d565c45f828a7ad1516b) that removes the untrusted input usage and resolves the injection risk.

The vulnerability can be exercised remotely, as the description states the attack can be executed remotely. The EPSS score of 2% indicates a low but non‑zero probability of exploitation; however, the public disclosure and the existence of a known exploit imply that attackers could target vulnerable installations. The vulnerability is not listed in the CISA KEV catalog, but its moderate CVSS score warrants timely patching to prevent possible module compromise or higher‑level takeovers.