9.8
Critique
CVE-2026-6951 Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete…
Description
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| simple-git 3.36 | premières → < 3.36.0 | 3.36.0 |
| org.webjars.npm:simple-git | Versions non publiées | |
| Red Hat Enterprise Linux 8 | Versions non publiées | |
| Red Hat Enterprise Linux 9 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions non publiées | |
| Red Hat Process Automation 7 | Versions non publiées |
Références
- security.snyk.io security.snyk.io
- security.snyk.io security.snyk.io
- gist.github.com gist.github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de simple-git
Les 5 CVE de simple-git →
CVE-2022-25860
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(),…
8.1
Élevée
CVE-2022-25912
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport…
8.1
Élevée
CVE-2022-24066
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of…
8.1
Élevée
CVE-2022-24433
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection
8.1
Élevée