HIGH🇬🇧 English

CVE-2022-25912

CVSS 8.1v3.1pub. 2022-12-06upd. 2025-04-22

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Simple Git Project Simple Git

    APP
    Simple-Git Project
    < 3.15.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCECommand Injection
CWE
Referencje

Powiązane podatności

CVE-2026-28292CRITICAL9.8PL ✓ten sam produkt

RCE w Simple-Git — ominięcie wcześniejszych poprawek CVE

CVE-2026-6951HIGH8.2ten sam produkt

Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incom...

CVE-2026-28291HIGH8.1ten sam produkt

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow exec...

CVE-2022-25860HIGH8.1ten sam produkt

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone()...

CVE-2022-24066HIGH8.1ten sam produkt

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-...