The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).
References
| Link | Resource |
|---|---|
| https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504 | Patch Third Party Advisory |
| https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0 | Release Notes Third Party Advisory |
| https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532 | Exploit Patch Third Party Advisory |
| https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221 | Exploit Patch Third Party Advisory |
| https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols | Broken Link |
Advertisement
Configurations
Information
Published : 2022-12-05 21:15
Updated : 2022-12-07 08:21
NVD link : CVE-2022-25912
Mitre link : CVE-2022-25912
JSON object : View
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Advertisement
Products Affected
simple-git_project
- simple-git