CVE-2021-23326

CVE-2021-23326 is a critical command injection vulnerability affecting versions of the @graphql-tools/git-loader package prior to 6.2.6. It allows unauthenticated attackers to execute arbitrary commands due to the insecure use of exec and execSync functions in the load-git.ts file. With a CVSS score of 8.8 (High), this vulnerability presents a significant risk, enabling full compromise of confidentiality, integrity, and availability with low attack complexity. While no active exploitation, public exploits, or significant community discussion have been observed, the potential for severe impact necessitates prompt patching.