CVE-2022-25860
CVE-2022-25860
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).
CVSS 8.1 · High · EPSS 2.7% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
simple-git
- Versions
- ≥ 0, < 3.16.0: Affected (semver)
Update to 3.16.0
simple-git npm
- Affected ranges
- SEMVER: < 3.16.0
Update to 3.16.0