@altostra/cli (>=5.15.0, <=5.15.2), @altostra/core (>=10.0.0-version-usage.0, <=10.2.0-support-aws-marketplace.2) +50 more potentially affected by CVE-2022-24066 +1 more via simple-git (>=3.0.3, <=3.4.0)

simple-git NPM version =3.0.3, =5.15.0, =10.0.0-version-usage.0, =1.1.12, =0.0.1, =1.1.1, =12.2.17, =18.2.13, =2.0.8, =1.0.3, =2.0.8, =2.0.0, =2.0.0, =1.0.3, =4.2.0 and more Source cves: CVE-2022-24066, CVE-2022-24433 Source advisory: SNYK:JS-SIMPLEGIT-2434306...

@manniwatch/client-desktop (>=0.28.0, <=0.28.1), @yeti-dev/electroshot (>=1.4.3, <=1.4.6) +5 more potentially affected by CVE-2022-21718 via electron (>=15.0.0, <=15.3.2)

electron NPM version =15.0.0, =0.28.0, =1.4.3, =1.0.0, =2.0.53, =6.0.15, =6.1.2 - simple-git-gui 3.8.2 - xyz-ttooc-log-electron-windows 0.1.5 Source cves: CVE-2022-21718 Source advisory: GHSA-3P22-GHQ8-V749...

GHSA-3F95-R44V-8MRG Command injection in simple-git

The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it was possible to get arbitrary...

@cronapp/devops (>=0.0.1, <=0.0.63), @k186/cli-service (>=2.0.8, <=4.2.0) +36 more potentially affected by CVE-2022-24433 via simple-git (>=3.0.3, <=3.2.6)

simple-git NPM version =3.0.3, =0.0.1, =2.0.8, =1.0.3, =2.0.8, =2.0.0, =2.0.0, =1.0.3, =1.0.3, =1.0.3, =1.0.3, =1.0.4, =1.0.7, =1.0.3, =1.0.3, =1.0.3, =4.2.0 and more Source cves: CVE-2022-24433 Source advisory: OSV:GHSA-3F95-R44V-8MRG...

@cronapp/devops (>=0.0.1, <=0.0.63), @k186/cli-service (>=2.0.8, <=4.2.0) +36 more potentially affected by CVE-2022-24433 via simple-git (>=3.0.3, <=3.2.6)

simple-git NPM version =3.0.3, =0.0.1, =2.0.8, =1.0.3, =2.0.8, =2.0.0, =2.0.0, =1.0.3, =1.0.3, =1.0.3, =1.0.3, =1.0.4, =1.0.7, =1.0.3, =1.0.3, =1.0.3, =4.2.0 and more Source cves: CVE-2022-24433 Source advisory: GHSA-3F95-R44V-8MRG...

Command injection in simple-git

The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it was possible to get arbitrary...

CVE-2022-24433

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary...

Command injection

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary...

CVE-2022-24433

CVE-2022-24433 affects the Node.js module simple-git (pre-3.5.0) and allows command injection via argument injection in the fetch path. The vulnerability arises because remote/branch values passed to the git fetch subcommand can be manipulated to execute arbitrary commands; the issue also concern...

1508-cli (>=1.0.4, <=1.0.6), 40banner (>=1.0.0, <=1.1.2) +4479 more potentially affected by CVE-2022-24433 via simple-git (>=0.1.2, <=3.2.6)

simple-git NPM version =0.1.2, =1.0.4, =1.0.0, =0.0.80, =1.0.0, =2.0.0, =0.0.0, =0.0.1, =0.0.1, =0.0.5, =0.0.5, =0.0.5, =0.0.5, =0.0.5, =0.1.16 and more Source cves: CVE-2022-24433 Source advisory: MEND:CVE-2022-24433...

CVE-2022-24433 Command Injection

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary...

CVE-2022-24433

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary...

CVE-2022-24433 Command Injection

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary...

CVE-2022-24433

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary...

Command Injection

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are...

@cronapp/devops (>=0.0.1, <=0.0.63), @k186/cli-service (>=2.0.8, <=4.2.0) +36 more potentially affected by CVE-2022-24433 via simple-git (>=3.0.3, <=3.2.6)

simple-git NPM version =3.0.3, =0.0.1, =2.0.8, =1.0.3, =2.0.8, =2.0.0, =2.0.0, =1.0.3, =1.0.3, =1.0.3, =1.0.3, =1.0.4, =1.0.7, =1.0.3, =1.0.3, =1.0.3, =4.2.0 and more Source cves: CVE-2022-24433 Source advisory: SNYK:JS-SIMPLEGIT-2421199...

PT-2022-16694 · Unknown · Simple-Git

Name of the Vulnerable Software and Affected Versions: simple-git versions prior to 3.3.0 Description: The issue allows for Command Injection via argument injection. When calling the fetch function with parameters remote, branch, and handlerFn, both the remote and branch parameters are passed to...

Simple-Git-Hooks parameter injection vulnerability

simple-git-hooks is an application. A simple git hooks manager for small projects A parameter injection vulnerability exists in simple-git-hooks, which stems from the fact that when the .fetchremote, branch, handlerFn function is called, both the remote and branch parameters are passed to the git...

CVE-2022-24433: Improper Neutralization of Argument Delimiters in a Command

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary...