CVEvulnerability
CVE-2022-25912
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-12-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78
Description
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.
Affected configurations
• simple-git project simple-git (< 3.15.0)
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols Broken Link
- https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504 Patch, Third Party Advisory
- https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0 Release Notes, Third Party Advisory
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532 Exploit, Patch, Third Party Advisory
- https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221 Exploit, Patch, Third Party Advisory
- https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols Broken Link
- https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504 Patch, Third Party Advisory
- https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0 Release Notes, Third Party Advisory
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532 Exploit, Patch, Third Party Advisory
- https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221 Exploit, Patch, Third Party Advisory