CVE-2021-44684: GitHub-Todos Project GitHub-Todos

Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days.

naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is directly used by the exec function.

Affected products

• GitHub-Todos Project GitHub-Todos: up to and including 3.1.0

Published 2021-12-07. Last modified 2026-06-17.