unspecified vulnerability in simple-git-hooks

simple-git-hooks is an application. A simple git hooks manager for small projects. simple-git-hooks versions prior to 3.5.0 have security vulnerabilities that attackers exploit for command injection...

Command Injection

simple-git is vulnerable to command injection. The vulnerability exists in cloneTask function in clone.ts due to the use of --upload-pack in git.clone which allows an attacker to inject and execute arbitrary codes. This is possible due to an incomplete fix of CVE-2022-24433...

@altostra/cli (>=5.15.0, <=5.15.2), @altostra/core (>=10.0.0-version-usage.0, <=10.2.0-support-aws-marketplace.2) +50 more potentially affected by CVE-2022-24066 via simple-git (>=3.0.3, <=3.4.0)

simple-git NPM version =3.0.3, =5.15.0, =10.0.0-version-usage.0, =1.1.12, =0.0.1, =1.1.1, =12.2.17, =18.2.13, =2.0.8, =1.0.3, =2.0.8, =2.0.0, =2.0.0, =1.0.3, =4.2.0 and more Source cves: CVE-2022-24066 Source advisory: OSV:GHSA-28XR-MWXG-3QC8...

GHSA-28XR-MWXG-3QC8 Command injection in simple-git

simple-git maintained as git-js named repository on GitHub is a light weight interface for running git commands in any node.js application.The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch...

Command injection in simple-git

simple-git maintained as git-js named repository on GitHub is a light weight interface for running git commands in any node.js application.The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch...

CVE-2022-24066

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover...

Command injection

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover...

CVE-2022-24066 Command Injection

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover...

CVE-2022-24066

The CVE-2022-24066 issue affects the simple-git package prior to version 3.5.0, where command injection is possible due to an incomplete fix of CVE-2022-24433 and exposure via --upload-pack during fetch and an analogous path for git clone. Affected software: simple-git (Node.js). Root cause: inco...

CVE-2022-24066 Command Injection

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover...

CVE-2022-24066

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover...

simple-git-hooks 参数注入漏洞

simple-git-hooks is an application. A simple git hooks manager for small projects. simple-git-hooks versions prior to 3.5.0 have security vulnerabilities that attackers exploit for command injection...

CVE-2022-24066: Improper Neutralization of Argument Delimiters in a Command

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover...

@altostra/cli (>=5.15.0, <=5.15.2), @altostra/core (>=10.0.0-version-usage.0, <=10.2.0-support-aws-marketplace.2) +50 more potentially affected by CVE-2022-24066 +1 more via simple-git (>=3.0.3, <=3.4.0)

simple-git NPM version =3.0.3, =5.15.0, =10.0.0-version-usage.0, =1.1.12, =0.0.1, =1.1.1, =12.2.17, =18.2.13, =2.0.8, =1.0.3, =2.0.8, =2.0.0, =2.0.0, =1.0.3, =4.2.0 and more Source cves: CVE-2022-24066, CVE-2022-24433 Source advisory: SNYK:JS-SIMPLEGIT-2434306...

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' due to an incomplete fix of CVE-2022-24433 which only patches...

@cronapp/devops (>=0.0.1, <=0.0.63), @k186/cli-service (>=2.0.8, <=4.2.0) +36 more potentially affected by CVE-2022-24433 via simple-git (>=3.0.3, <=3.2.6)

simple-git NPM version =3.0.3, =0.0.1, =2.0.8, =1.0.3, =2.0.8, =2.0.0, =2.0.0, =1.0.3, =1.0.3, =1.0.3, =1.0.3, =1.0.4, =1.0.7, =1.0.3, =1.0.3, =1.0.3, =4.2.0 and more Source cves: CVE-2022-24433 Source advisory: OSV:GHSA-3F95-R44V-8MRG...

Command injection in simple-git

The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it was possible to get arbitrary...

GHSA-3F95-R44V-8MRG Command injection in simple-git

The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it was possible to get arbitrary...

CVE-2022-24433

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary...

Command injection

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary...