CVE-2022-25860: Code Injection
Published Jan 24, 2023
·Updated
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of CVE-2022-25912.
Other sources
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of CVE-2022-25912.
— GitHub
Affected Software
2 affected componentsFixes available
Simple-git Project Simple-git Node.js<3.16.0
npm/simple-git<3.16.0
3.16.0
Remediation
Event History
Jan 24, 2023
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
DescriptionSeverityWeakness
Jan 26, 2023
Data Sourced
via NVD·09:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·09:30 PM