Command Injection Vulnerability in Git Repository Status (GHSA-q6hm-vf4f-47jf) Severity Moderate CVSS v3 base score: 6.3/10 Impact Arbitrary command injection can lead to remote code execution under specific conditions: Liquid Prompt must contain commit . must be enabled. must be set up as described in the configuration documentation. Bash: must be enabled. Zsh: must be enabled. A compromised Git repository must be cloned and entered. A branch name with command injection syntax is checked out. Affected Versions cf3441250bb5d8b45f6f8b389fcd427a99ac28a Patched Versions a4f6b8d8c90b3eaa33d13dfd1093062ab9c4b30c Workaround Set to . Patch Commit contains a patch. - If using the branch, pull immediately. - If using or packaged versions, not vulnerable. How to Check Vulnerability