@conventional-changelog/git-client has an Argument Injection vulnerability

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-59433 · Microsoft / collected KEV context

EUVD-2025-30450

GHSA-vh25-5764-9wcr

cve-program · CVE-2025-59433

• https://github.com/conventional-changelog/conventional-changelog/security/advisories/GHSA-vh25-5764-9wcr
• https://github.com/conventional-changelog/conventional-changelog/commit/d95c9ffac05af58228bd89fa0ba37ad65741c6a2

euvd · EUVD-2025-30450

• https://github.com/conventional-changelog/conventional-changelog/security/advisories/GHSA-vh25-5764-9wcr
• https://github.com/conventional-changelog/conventional-changelog/commit/d95c9ffac05af58228bd89fa0ba37ad65741c6a2

nvd · CVE-2025-59433

• https://github.com/conventional-changelog/conventional-changelog/commit/d95c9ffac05af58228bd89fa0ba37ad65741c6a2
• https://github.com/conventional-changelog/conventional-changelog/security/advisories/GHSA-vh25-5764-9wcr

osv · GHSA-vh25-5764-9wcr

• https://github.com/conventional-changelog/conventional-changelog/security/advisories/GHSA-vh25-5764-9wcr
• https://nvd.nist.gov/vuln/detail/CVE-2025-59433
• https://github.com/conventional-changelog/conventional-changelog/commit/d95c9ffac05af58228bd89fa0ba37ad65741c6a2
• https://github.com/conventional-changelog/conventional-changelog

No related operational record is retained in the current change model.