CVE-2021-3190: Async-Git Project Async-Git

Critical severity, CVSS 9.8. EPSS: 5.3% chance of exploitation in the next 30 days.

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.

Affected products

• Async-Git Project Async-Git: before 1.13.2 (fixed in 1.13.2)

Published 2021-01-26. Last modified 2026-06-17.