CVE-2022-25766

The CVE describes a remote code execution in ungit prior to 1.5.20 caused by argument injection in the /api/fetch endpoint. User-controlled values (remote and ref) are injected into the git fetch command, enabling arbitrary command execution on the server. Affected product: ungit (pre-1.5.20). Ro...