CVE-2022-25912
CVE-2022-25912 · Remote Code Execution (RCE)
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).
CVSS 8.1 · High · EPSS 3.1% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
simple-git
- Versions
- ≥ unspecified, < 3.15.0: Affected (custom)
Update to 3.15.0
simple-git npm
- Affected ranges
- SEMVER: < 3.15.0
Update to 3.15.0
Original sources
- https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
- https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504
- https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0
- https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols
- https://nvd.nist.gov/vuln/detail/CVE-2022-25912