CVE-2022-25860

Published Jan 26, 2023

Last updated a year ago

CVSS critical 9.8

Overview

Description: Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).
Source: report@snyk.io
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo
report@snyk.io: CWE-94

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:simple-git_project:simple-git:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "76F895F7-B474-402B-A54D-0AD13BFADD65",
            "versionEndExcluding": "3.16.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References