GitHub Advisoryadvisory · npm

GHSA-28xr-mwxg-3qc8 Command injection in simple-git

HIGH Published 2022-04-02 Modified 2022-10-13 Official page ↗
Aliases
CVE-2022-24066
Ecosystem
npm
Packages
simple-git
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-88
Reviewed
2022-04-04

Affected packages

• npm simple-git: < 3.5.0 → fixed in 3.5.0

Description

`simple-git` (maintained as git-js named repository on GitHub) is a light weight interface for running git commands in any node.js application.The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover. A fix was released in [email protected].

Related

Alias · CVE (1)

  • CVE-2022-24066 The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of… vulnerability

Weakness · CWE (1)

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References