Remote Code Execution (RCE)

simple-git is vulnerable to remote code execution.The vulnerability exists in the clone function of git.js because of enabling the ext transport protocol which allows an attacker to inject and execute arbitrary codes into the system. This is an incomplete fix of CVE-2022-24066...

OS Command Injection

mversion is vulnerable to OS Command Injection. The vulnerability exists as the value of tagName in lib/git.js is passed to cp.exec without validation or sanitization, allowing an attacker to inject and execute arbitrary code...