CVE-2022-25766

Remote Code Execution (RCE)

High · published March 21, 2022

CVSS v3.1

8.8

EPSS

35%

Percentile

98.4

In the wild

Unconfirmed

What it is

The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git options it was possible to get arbitrary command execution.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.34543 · 98.4th percentile
Published: 2022-03-21T17:15Z

EPSS history

Timeline

21 MAR 17:15Z
Remote Code Execution (RCE)
cvelistv5