CVE-2022-25912: Remote Code Execution (RCE)
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.
Other sources
The package simple-git before 3.15.0 is vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-25912?
CVE-2022-25912 is a vulnerability in the package simple-git before version 3.15.0 that allows remote code execution (RCE) via the `clone()` method when the `ext` transport protocol is enabled.
How severe is CVE-2022-25912?
CVE-2022-25912 has a severity rating of 8.1 (High).
How can I fix CVE-2022-25912?
To fix CVE-2022-25912, you should update the simple-git package to version 3.15.0 or higher.
What is the Common Weakness Enumeration (CWE) ID for CVE-2022-25912?
The Common Weakness Enumeration (CWE) ID for CVE-2022-25912 is CWE-78.
Where can I find more information about CVE-2022-25912?
You can find more information about CVE-2022-25912 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-25912), [GitHub Commit](https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504), [GitHub Plugin Unsafe Actions](https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols)