CVE-2022-25912

Remote Code Execution (RCE)

High · published December 12, 2022

CVSS v3.1
8.1
EPSS
3%
Percentile
87.6
In the wild
Unconfirmed
What it is

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
CVSS v4.0
Not supplied
EPSS
0.03077 · 87.6th percentile
Published
2022-12-12T01:49Z
EPSS history
Timeline
  • 12 DEC 01:49Z
    Remote Code Execution (RCE)
    cvelistv5