Vulnerability · Published Dec 12, 2022 · Assigned by snyk
CVE-2022-25912Remote Code Execution (RCE)
High 8.1
In plain English
A high-severity OS command injection in simple-git. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | simple-git | 3.15.0 | GHSA-9p95-fxvg-qgq2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | simple-git | unspecified – before 3.15.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
References
- https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
- https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504
- https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0
- https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols