Skip to content
Sign in
8.1 High

CVE-2022-25648 The package git before 1.11.0 are vulnerable to Command Injection via git argument injection

Description

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Affected products and versions

Product Affected versions Fixed in
git 1.11 earliest → < 1.11.0 1.11.0

Other CVEs of git

The 2 CVEs of git →
CVE-2021-23632 All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git… 6.6 Medium
Track this CVE