CVE-2022-25860CWE-94

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to…

High · published January 24, 2023

CVSS v3.1
8.1
EPSS
3%
Percentile
85.9
In the wild
Unconfirmed
What it is

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
CVSS v4.0
Not supplied
EPSS
0.02712 · 85.9th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2023-01-24T05:00Z
EPSS history
Timeline
  • 24 JAN 05:00Z
    Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to…
    cvelistv5