CVE-2022-25912 Remote Code Execution (RCE)

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution RCE when enabling the ext transport protocol, which makes it exploitable via clone method. This vulnerability exists due to an incomplete fix of CVE-2022-24066...

CVE-2022-25912

CVE-2022-25912 affects the Node.js simple-git module prior to 3.16.0, with remote code execution via the ext transport protocol during clone() (incomplete fix of CVE-2022-24066). Several connected sources corroborate RCE via clone()/pull()/push()/listRemote() paths when input is crafted, with exp...

CVE-2022-25912

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution RCE when enabling the ext transport protocol, which makes it exploitable via clone method. This vulnerability exists due to an incomplete fix of "CVE-2022-24066" https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306...

1508-cli (>=1.0.4, <=1.0.6), 40banner (>=1.0.0, <=1.1.2) +4574 more potentially affected by CVE-2022-25912 via simple-git (>=0.1.2, <=3.14.1)

simple-git NPM version =0.1.2, =1.0.4, =1.0.0, =0.0.80, =1.0.0, =2.0.0, =0.0.0, =0.0.1, =0.0.1, =0.0.5, =0.0.5, =0.0.5, =0.0.5, =0.0.5, =0.1.16 and more Source cves: CVE-2022-25912 Source advisory: MEND:CVE-2022-25912...

CVE-2022-25912: Improper Neutralization of Special Elements used in an OS Command

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution RCE when enabling the ext transport protocol, which makes it exploitable via clone method. This vulnerability exists due to an incomplete fix of CVE-2022-24066...

Remote Code Execution (RCE)

simple-git is vulnerable to remote code execution.The vulnerability exists in the clone function of git.js because of enabling the ext transport protocol which allows an attacker to inject and execute arbitrary codes into the system. This is an incomplete fix of CVE-2022-24066...

GHSA-9P95-FXVG-QGQ2 simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol

The package simple-git before 3.15.0 is vulnerable to Remote Code Execution RCE when enabling the ext transport protocol, which makes it exploitable via clone method. This vulnerability exists due to an incomplete fix of CVE-2022-24066...

simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol

The package simple-git before 3.15.0 is vulnerable to Remote Code Execution RCE when enabling the ext transport protocol, which makes it exploitable via clone method. This vulnerability exists due to an incomplete fix of CVE-2022-24066...

@abstraktor/actordemo (>=0.0.0-ad-beta.1, <=0.0.0-ad-beta.2), @abstraktor/actorjs (>=0.0.0-aj-alpha.9, <=0.0.0-aj-beta.6) +175 more potentially affected by CVE-2022-25912 via simple-git (>=3.0.3, <=3.14.1)

simple-git NPM version =3.0.3, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =1.4.0, =5.15.0, =10.0.0-version-usage.0, =1.0.1, =2.0.0, =1.1.0, =1.1.0, =0.0.0-semantic-release, =1.1.12, =0.0.1, =0.0.63 - @custis/file-adapter-front 1.1.1 and more Source cves: CVE-2022-25912 Source advisory: GHSA-9P95-FXVG-Q...

@abstraktor/actordemo (>=0.0.0-ad-beta.1, <=0.0.0-ad-beta.2), @abstraktor/actorjs (>=0.0.0-aj-alpha.9, <=0.0.0-aj-beta.6) +175 more potentially affected by CVE-2022-25912 via simple-git (>=3.0.3, <=3.14.1)

simple-git NPM version =3.0.3, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =1.4.0, =5.15.0, =10.0.0-version-usage.0, =1.0.1, =2.0.0, =1.1.0, =1.1.0, =0.0.0-semantic-release, =1.1.12, =0.0.1, =0.0.63 - @custis/file-adapter-front 1.1.1 and more Source cves: CVE-2022-25912 Source advisory:...

CVE-2022-25912 Remote Code Execution (RCE)

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution RCE when enabling the ext transport protocol, which makes it exploitable via clone method. This vulnerability exists due to an incomplete fix of CVE-2022-24066...

CVE-2022-25912

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution RCE when enabling the ext transport protocol, which makes it exploitable via clone method. This vulnerability exists due to an incomplete fix of CVE-2022-24066...

Design/Logic Flaw

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution RCE when enabling the ext transport protocol, which makes it exploitable via clone method. This vulnerability exists due to an incomplete fix of CVE-2022-24066...

PT-2022-17600

Name of the Vulnerable Software and Affected Versions simple-git versions prior to 3.15.0 Description The issue allows for Remote Code Execution RCE when the ext transport protocol is enabled, making it exploitable via the clone method. This is due to an incomplete fix of a previous issue...

@abstraktor/actordemo (>=0.0.0-ad-beta.1, <=0.0.0-ad-beta.2), @abstraktor/actorjs (>=0.0.0-aj-alpha.9, <=0.0.0-aj-beta.6) +175 more potentially affected by CVE-2022-24066 +1 more via simple-git (>=3.0.3, <=3.14.1)

simple-git NPM version =3.0.3, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =1.4.0, =5.15.0, =10.0.0-version-usage.0, =1.0.1, =2.0.0, =1.1.0, =1.1.0, =0.0.0-semantic-release, =1.1.12, =0.0.1, =0.0.63 - @custis/file-adapter-front 1.1.1 and more Source cves: CVE-2022-24066, CVE-2022-25912 Source advisory:...

Remote Code Execution (RCE)

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Remote Code Execution RCE when enabling the ext transport protocol, which makes it exploitable via clone method. This vulnerability exists due t...

@manniwatch/client-desktop (>=0.28.0, <=0.28.2), @yeti-dev/electroshot (>=1.4.3, <=1.4.6) +5 more potentially affected by CVE-2022-29247 via electron (>=15.0.0, <=15.3.7)

electron NPM version =15.0.0, =0.28.0, =1.4.3, =1.0.0, =2.0.53, =6.0.15, =6.1.2 - simple-git-gui 3.8.2 - xyz-ttooc-log-electron-windows 0.1.5 Source cves: CVE-2022-29247 Source advisory: GHSA-MQ8J-3H7H-P8G7...

unspecified vulnerability in simple-git-hooks

simple-git-hooks is an application. A simple git hooks manager for small projects. simple-git-hooks versions prior to 3.5.0 have security vulnerabilities that attackers exploit for command injection...

Command Injection

simple-git is vulnerable to command injection. The vulnerability exists in cloneTask function in clone.ts due to the use of --upload-pack in git.clone which allows an attacker to inject and execute arbitrary codes. This is possible due to an incomplete fix of CVE-2022-24433...

@altostra/cli (>=5.15.0, <=5.15.2), @altostra/core (>=10.0.0-version-usage.0, <=10.2.0-support-aws-marketplace.2) +50 more potentially affected by CVE-2022-24066 via simple-git (>=3.0.3, <=3.4.0)

simple-git NPM version =3.0.3, =5.15.0, =10.0.0-version-usage.0, =1.1.12, =0.0.1, =1.1.1, =12.2.17, =18.2.13, =2.0.8, =1.0.3, =2.0.8, =2.0.0, =2.0.0, =1.0.3, =4.2.0 and more Source cves: CVE-2022-24066 Source advisory: OSV:GHSA-28XR-MWXG-3QC8...