CVE-2022-24066

Command Injection

High · published April 1, 2022

CVSS v3.1
8.1
EPSS
4%
Percentile
90.2
In the wild
Unconfirmed
What it is

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03896 · 90.2th percentile
Published
2022-04-01T20:00Z
EPSS history
Timeline
  • 01 APR 20:00Z
    Command Injection
    cvelistv5