8.1
High
CVE-2022-25860 Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(),…
Description
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| simple-git 3.16 | earliest → < 3.16.0 | 3.16.0 |
References
- security.snyk.io security.snyk.io
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of simple-git
The 5 CVEs of simple-git →
CVE-2026-6951
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete…
9.8
Critical
CVE-2022-25912
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport…
8.1
High
CVE-2022-24066
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of…
8.1
High
CVE-2022-24433
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection
8.1
High