CVE-2022-24433: Command Injection
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-24433?
CVE-2022-24433 is a vulnerability in the package simple-git before version 3.3.0 that allows for command injection via argument injection.
What is the severity of CVE-2022-24433?
The severity of CVE-2022-24433 is critical with a CVSS score of 9.8.
How does CVE-2022-24433 affect simple-git?
CVE-2022-24433 affects versions of simple-git up to and excluding 3.3.0.
How can I fix CVE-2022-24433?
To fix CVE-2022-24433, make sure to update the simple-git package to version 3.3.0 or higher.
What is the Common Weakness Enumeration (CWE) ID for CVE-2022-24433?
The CWE IDs associated with CVE-2022-24433 are CWE-77 and CWE-88.