8.1
High
CVE-2022-24066 The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of…
Description
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| simple-git 3.5 | earliest → < 3.5.0 | 3.5.0 |
References
- snyk.io snyk.io
- snyk.io snyk.io
- gist.github.com gist.github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of simple-git
The 5 CVEs of simple-git →
CVE-2026-6951
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete…
9.8
Critical
CVE-2022-25860
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(),…
8.1
High
CVE-2022-25912
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport…
8.1
High
CVE-2022-24433
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection
8.1
High