HIGH🇵🇱 Wersja polska

CVE-2022-25860

CVSS 8.1v3.1pub. 2023-01-26upd. 2025-04-01

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Simple Git Project Simple Git

    APP
    Simple-Git Project
    < 3.16.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCECommand Injection
CWE
References

Related vulnerabilities

CVE-2026-28292CRITICAL9.8PL ✓ten sam produkt

RCE w Simple-Git — ominięcie wcześniejszych poprawek CVE

CVE-2026-6951HIGH8.2ten sam produkt

Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incom...

CVE-2026-28291HIGH8.1ten sam produkt

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow exec...

CVE-2022-25912HIGH8.1ten sam produkt

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext trans...

CVE-2022-24066HIGH8.1ten sam produkt

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-...