GitHub Advisoryadvisory · npm

GHSA-9w5j-4mwv-2wj8 Remote code execution in simple-git

CRITICAL Published 2023-01-26 Modified 2025-04-01 Official page ↗
Aliases
CVE-2022-25860
Ecosystem
npm
Packages
simple-git
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78, CWE-94
Reviewed
2023-01-27

Affected packages

• npm simple-git: < 3.16.0 → fixed in 3.16.0

Description

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of CVE-2022-25912.

Related

Alias · CVE (1)

  • CVE-2022-25860 Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and… vulnerability

Weakness · CWE (2)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
  • CWE-94 Improper Control of Generation of Code weakness

References