What’s Vulnerable › Vulnerabilities

CVE-2021-32673: Remote Command Execution in reg-keygen-git-hash-plugin

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-08 · updated 2026-06-17
• Weakness: CWE-94

Description

reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and including 0.10.15 allow remote attackers to execute of arbitrary commands. Upgrade to version 0.10.16 or later to resolve this issue.

Affected products

• reg-viz reg-suit: through 0.10.15

References

• https://github.com/reg-viz/reg-suit/commit/f84ad9c7a22144d6c147dc175c52756c0f444d87
• https://github.com/reg-viz/reg-suit/releases/tag/v0.10.16
• https://github.com/reg-viz/reg-suit/security/advisories/GHSA-49q3-8867-5wmp
• https://www.npmjs.com/package/reg-keygen-git-hash-plugin
• https://github.com/reg-viz/reg-suit/commit/f84ad9c7a22144d6c147dc175c52756c0f444d87
• https://github.com/reg-viz/reg-suit/releases/tag/v0.10.16
• https://github.com/reg-viz/reg-suit/security/advisories/GHSA-49q3-8867-5wmp
• https://www.npmjs.com/package/reg-keygen-git-hash-plugin

Get alerted when CVE-2021-32673 or the next vulnerability affects your stack