REDHAT-BUG-2446162: High severity npm/simple-git vulnerability
simple-git, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
simple-gitto a version that resolves this vulnerability.Fixed in 3.23.0 - Compensating control
Assume the affected simple-git versions (3.15.0 through 3.32.2) can be exploited for full remote code execution; restrict access to any exposed functionality or endpoints that could allow an attacker to trigger the vulnerable code path until upgraded to 3.23.0.
Event History
Frequently Asked Questions
Which simple-git versions are affected, and which version includes the updated fix?
Versions 3.15.0 through 3.32.2 are identified as affected. The data states that version 3.23.0 contains an updated fix.
What is the potential impact if this issue is exploited?
An attacker may bypass fixes for CVE-2022-25860 and CVE-2022-25912 and achieve full remote code execution on the host machine.