CVE-2025-59831

CVE-2025-59831 is a critical command injection vulnerability affecting the riceball git_commiters Node.js module prior to version 0.1.2. This flaw allows an attacker to execute arbitrary commands by injecting malicious input into the gitCommiters function's options, specifically via the cwd or revisionRange parameters. With a CVSS score of 8.8 (HIGH), this vulnerability presents a significant risk, enabling full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) with low attack complexity and requiring user interaction (UI:R). Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion, suggesting it is not widely known or exploited in the wild.