CVE-2026-16492

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16492", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-21T16:04:58.786Z", "datePublished": "2026-07-22T00:45:11.924Z", "dateUpdated": "2026-07-22T13:02:16.404Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-22T00:45:11.924Z"}, "title": "umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "OS Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}], "affected": [{"vendor": "umijs", "product": "umi", "versions": [{"version": "4.6.0", "status": "affected"}, {"version": "4.6.1", "status": "affected"}, {"version": "4.6.2", "status": "affected"}, {"version": "4.6.3", "status": "affected"}, {"version": "4.6.4", "status": "affected"}, {"version": "4.6.5", "status": "affected"}, {"version": "4.6.6", "status": "affected"}, {"version": "4.6.7", "status": "affected"}, {"version": "4.6.8", "status": "affected"}, {"version": "4.6.9", "status": "affected"}, {"version": "4.6.10", "status": "affected"}, {"version": "4.6.11", "status": "affected"}, {"version": "4.6.12", "status": "affected"}, {"version": "4.6.13", "status": "affected"}, {"version": "4.6.14", "status": "affected"}, {"version": "4.6.15", "status": "affected"}, {"version": "4.6.16", "status": "affected"}, {"version": "4.6.17", "status": "affected"}, {"version": "4.6.18", "status": "affected"}, {"version": "4.6.19", "status": "affected"}, {"version": "4.6.20", "status": "affected"}, {"version": "4.6.21", "status": "affected"}, {"version": "4.6.22", "status": "affected"}, {"version": "4.6.23", "status": "affected"}, {"version": "4.6.24", "status": "affected"}, {"version": "4.6.25", "status": "affected"}, {"version": "4.6.26", "status": "affected"}, {"version": "4.6.27", "status": "affected"}, {"version": "4.6.28", "status": "affected"}, {"version": "4.6.29", "status": "affected"}, {"version": "4.6.30", "status": "affected"}, {"version": "4.6.31", "status": "affected"}, {"version": "4.6.32", "status": "affected"}, {"version": "4.6.33", "status": "affected"}, {"version": "4.6.34", "status": "affected"}, {"version": "4.6.35", "status": "affected"}, {"version": "4.6.36", "status": "affected"}, {"version": "4.6.37", "status": "affected"}, {"version": "4.6.38", "status": "affected"}, {"version": "4.6.39", "status": "affected"}, {"version": "4.6.40", "status": "affected"}, {"version": "4.6.41", "status": "affected"}, {"version": "4.6.42", "status": "affected"}, {"version": "4.6.43", "status": "affected"}, {"version": "4.6.44", "status": "affected"}, {"version": "4.6.45", "status": "affected"}, {"version": "4.6.46", "status": "affected"}, {"version": "4.6.47", "status": "affected"}, {"version": "4.6.48", "status": "affected"}, {"version": "4.6.49", "status": "affected"}, {"version": "4.6.50", "status": "affected"}, {"version": "4.6.51", "status": "affected"}, {"version": "4.6.52", "status": "affected"}, {"version": "4.6.53", "status": "affected"}, {"version": "4.6.54", "status": "affected"}, {"version": "4.6.55", "status": "affected"}, {"version": "4.6.56", "status": "affected"}, {"version": "4.6.57", "status": "affected"}, {"version": "4.6.58", "status": "affected"}, {"version": "4.6.59", "status": "affected"}, {"version": "4.6.60", "status": "affected"}, {"version": "4.6.61", "status": "affected"}, {"version": "4.6.62", "status": "affected"}, {"version": "4.6.63", "status": "affected"}, {"version": "4.6.64", "status": "unaffected"}], "cpes": ["cpe:2.3:a:umijs:umi:*:*:*:*:*:*:*:*"], "modules": ["GIT File Helper"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.6.64 is sufficient to fix this issue. Patch name: b6da12c17b024a43badb1fa565720c38cf42e647. Upgrading the affected component is advised."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.5, "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.2, "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-07-21T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-21T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-21T18:10:29.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "wjm2 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/380948", "name": "VDB-380948 | umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/380948/cti", "name": "VDB-380948 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16492", "name": "CVE-2026-16492 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/860128", "name": "Submit #860128 | Node.js @umijs/utils 4.6.63 OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/umijs/umi/issues/13345", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/umijs/umi/pull/13347", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/umijs/umi/commit/b6da12c17b024a43badb1fa565720c38cf42e647", "tags": ["patch"]}, {"url": "https://github.com/umijs/umi/releases/tag/v4.6.64", "tags": ["patch"]}, {"url": "https://github.com/umijs/umi/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T13:02:01.315106Z", "id": "CVE-2026-16492", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T13:02:16.404Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16492", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T13:02:01.315106Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T13:02:09.815Z"}}], "cna": {"tags": ["x_open-source"], "title": "umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection", "credits": [{"lang": "en", "type": "reporter", "value": "wjm2 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.2, "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:umijs:umi:*:*:*:*:*:*:*:*"], "vendor": "umijs", "modules": ["GIT File Helper"], "product": "umi", "versions": [{"status": "affected", "version": "4.6.0"}, {"status": "affected", "version": "4.6.1"}, {"status": "affected", "version": "4.6.2"}, {"status": "affected", "version": "4.6.3"}, {"status": "affected", "version": "4.6.4"}, {"status": "affected", "version": "4.6.5"}, {"status": "affected", "version": "4.6.6"}, {"status": "affected", "version": "4.6.7"}, {"status": "affected", "version": "4.6.8"}, {"status": "affected", "version": "4.6.9"}, {"status": "affected", "version": "4.6.10"}, {"status": "affected", "version": "4.6.11"}, {"status": "affected", "version": "4.6.12"}, {"status": "affected", "version": "4.6.13"}, {"status": "affected", "version": "4.6.14"}, {"status": "affected", "version": "4.6.15"}, {"status": "affected", "version": "4.6.16"}, {"status": "affected", "version": "4.6.17"}, {"status": "affected", "version": "4.6.18"}, {"status": "affected", "version": "4.6.19"}, {"status": "affected", "version": "4.6.20"}, {"status": "affected", "version": "4.6.21"}, {"status": "affected", "version": "4.6.22"}, {"status": "affected", "version": "4.6.23"}, {"status": "affected", "version": "4.6.24"}, {"status": "affected", "version": "4.6.25"}, {"status": "affected", "version": "4.6.26"}, {"status": "affected", "version": "4.6.27"}, {"status": "affected", "version": "4.6.28"}, {"status": "affected", "version": "4.6.29"}, {"status": "affected", "version": "4.6.30"}, {"status": "affected", "version": "4.6.31"}, {"status": "affected", "version": "4.6.32"}, {"status": "affected", "version": "4.6.33"}, {"status": "affected", "version": "4.6.34"}, {"status": "affected", "version": "4.6.35"}, {"status": "affected", "version": "4.6.36"}, {"status": "affected", "version": "4.6.37"}, {"status": "affected", "version": "4.6.38"}, {"status": "affected", "version": "4.6.39"}, {"status": "affected", "version": "4.6.40"}, {"status": "affected", "version": "4.6.41"}, {"status": "affected", "version": "4.6.42"}, {"status": "affected", "version": "4.6.43"}, {"status": "affected", "version": "4.6.44"}, {"status": "affected", "version": "4.6.45"}, {"status": "affected", "version": "4.6.46"}, {"status": "affected", "version": "4.6.47"}, {"status": "affected", "version": "4.6.48"}, {"status": "affected", "version": "4.6.49"}, {"status": "affected", "version": "4.6.50"}, {"status": "affected", "version": "4.6.51"}, {"status": "affected", "version": "4.6.52"}, {"status": "affected", "version": "4.6.53"}, {"status": "affected", "version": "4.6.54"}, {"status": "affected", "version": "4.6.55"}, {"status": "affected", "version": "4.6.56"}, {"status": "affected", "version": "4.6.57"}, {"status": "affected", "version": "4.6.58"}, {"status": "affected", "version": "4.6.59"}, {"status": "affected", "version": "4.6.60"}, {"status": "affected", "version": "4.6.61"}, {"status": "affected", "version": "4.6.62"}, {"status": "affected", "version": "4.6.63"}, {"status": "unaffected", "version": "4.6.64"}]}], "timeline": [{"lang": "en", "time": "2026-07-21T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-21T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-21T18:10:29.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/380948", "name": "VDB-380948 | umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/380948/cti", "name": "VDB-380948 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16492", "name": "CVE-2026-16492 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/860128", "name": "Submit #860128 | Node.js @umijs/utils 4.6.63 OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/umijs/umi/issues/13345", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/umijs/umi/pull/13347", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/umijs/umi/commit/b6da12c17b024a43badb1fa565720c38cf42e647", "tags": ["patch"]}, {"url": "https://github.com/umijs/umi/releases/tag/v4.6.64", "tags": ["patch"]}, {"url": "https://github.com/umijs/umi/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.6.64 is sufficient to fix this issue. Patch name: b6da12c17b024a43badb1fa565720c38cf42e647. Upgrading the affected component is advised."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "OS Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-22T00:45:11.924Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16492", "state": "PUBLISHED", "dateUpdated": "2026-07-22T13:02:16.404Z", "dateReserved": "2026-07-21T16:04:58.786Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-22T00:45:11.924Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:umijs:umi:*:*:*:*:*:*:*:*"], "modules": ["GIT File Helper"], "product": "umi", "vendor": "umijs", "versions": [{"status": "affected", "version": "4.6.0"}, {"status": "affected", "version": "4.6.1"}, {"status": "affected", "version": "4.6.2"}, {"status": "affected", "version": "4.6.3"}, {"status": "affected", "version": "4.6.4"}, {"status": "affected", "version": "4.6.5"}, {"status": "affected", "version": "4.6.6"}, {"status": "affected", "version": "4.6.7"}, {"status": "affected", "version": "4.6.8"}, {"status": "affected", "version": "4.6.9"}, {"status": "affected", "version": "4.6.10"}, {"status": "affected", "version": "4.6.11"}, {"status": "affected", "version": "4.6.12"}, {"status": "affected", "version": "4.6.13"}, {"status": "affected", "version": "4.6.14"}, {"status": "affected", "version": "4.6.15"}, {"status": "affected", "version": "4.6.16"}, {"status": "affected", "version": "4.6.17"}, {"status": "affected", "version": "4.6.18"}, {"status": "affected", "version": "4.6.19"}, {"status": "affected", "version": "4.6.20"}, {"status": "affected", "version": "4.6.21"}, {"status": "affected", "version": "4.6.22"}, {"status": "affected", "version": "4.6.23"}, {"status": "affected", "version": "4.6.24"}, {"status": "affected", "version": "4.6.25"}, {"status": "affected", "version": "4.6.26"}, {"status": "affected", "version": "4.6.27"}, {"status": "affected", "version": "4.6.28"}, {"status": "affected", "version": "4.6.29"}, {"status": "affected", "version": "4.6.30"}, {"status": "affected", "version": "4.6.31"}, {"status": "affected", "version": "4.6.32"}, {"status": "affected", "version": "4.6.33"}, {"status": "affected", "version": "4.6.34"}, {"status": "affected", "version": "4.6.35"}, {"status": "affected", "version": "4.6.36"}, {"status": "affected", "version": "4.6.37"}, {"status": "affected", "version": "4.6.38"}, {"status": "affected", "version": "4.6.39"}, {"status": "affected", "version": "4.6.40"}, {"status": "affected", "version": "4.6.41"}, {"status": "affected", "version": "4.6.42"}, {"status": "affected", "version": "4.6.43"}, {"status": "affected", "version": "4.6.44"}, {"status": "affected", "version": "4.6.45"}, {"status": "affected", "version": "4.6.46"}, {"status": "affected", "version": "4.6.47"}, {"status": "affected", "version": "4.6.48"}, {"status": "affected", "version": "4.6.49"}, {"status": "affected", "version": "4.6.50"}, {"status": "affected", "version": "4.6.51"}, {"status": "affected", "version": "4.6.52"}, {"status": "affected", "version": "4.6.53"}, {"status": "affected", "version": "4.6.54"}, {"status": "affected", "version": "4.6.55"}, {"status": "affected", "version": "4.6.56"}, {"status": "affected", "version": "4.6.57"}, {"status": "affected", "version": "4.6.58"}, {"status": "affected", "version": "4.6.59"}, {"status": "affected", "version": "4.6.60"}, {"status": "affected", "version": "4.6.61"}, {"status": "affected", "version": "4.6.62"}, {"status": "affected", "version": "4.6.63"}, {"status": "unaffected", "version": "4.6.64"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.6.64 is sufficient to fix this issue. Patch name: b6da12c17b024a43badb1fa565720c38cf42e647. Upgrading the affected component is advised."}, {"lang": "es", "value": "Se ha identificado una debilidad en umijs umi hasta la versi\u00f3n 4.6.63. El elemento afectado es la funci\u00f3n git.getFileCreateInfo del archivo packages/utils/src/getFileGitIno.ts del componente GIT File Helper. Esta manipulaci\u00f3n causa inyecci\u00f3n de comandos del sistema operativo. El exploit se ha hecho p\u00fablico y podr\u00eda ser utilizado para ataques. Actualizar a la versi\u00f3n 4.6.64 es suficiente para solucionar este problema. Nombre del parche: b6da12c17b024a43badb1fa565720c38cf42e647. Se aconseja actualizar el componente afectado."}], "id": "CVE-2026-16492", "lastModified": "2026-10-24T17:10:00.220", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 5.2, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 5.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16492", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T13:02:01.315106Z", "version": "2.0.3"}}]}, "published": "2026-07-22T01:16:26.257", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/umijs/umi/"}, {"source": "cna@vuldb.com", "url": "https://github.com/umijs/umi/commit/b6da12c17b024a43badb1fa565720c38cf42e647"}, {"source": "cna@vuldb.com", "url": "https://github.com/umijs/umi/issues/13345"}, {"source": "cna@vuldb.com", "url": "https://github.com/umijs/umi/pull/13347"}, {"source": "cna@vuldb.com", "url": "https://github.com/umijs/umi/releases/tag/v4.6.64"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-16492"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/860128"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/380948"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/380948/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.6.0,4.6.63]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "4.6.64"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "umi", "source": "cna", "vendor": "umijs"}, "product": "umi", "vendor": "umijs"}], "created": "2026-07-23T19:15:04.552643+00:00", "updated": "2026-08-24T16:30:07.316841+00:00", "vendors": ["umijs", "umijs$PRODUCT$umi"]}