8.1
Élevée
CVE-2022-24066 The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of…
Description
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| simple-git 3.5 | premières → < 3.5.0 | 3.5.0 |
Références
- snyk.io snyk.io
- snyk.io snyk.io
- gist.github.com gist.github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de simple-git
Les 5 CVE de simple-git →
CVE-2026-6951
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete…
9.8
Critique
CVE-2022-25860
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(),…
8.1
Élevée
CVE-2022-25912
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport…
8.1
Élevée
CVE-2022-24433
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection
8.1
Élevée