PT-2022-17595 · Git-Clone · Git-Clone

Liran Tal · CVE-2022-25900 · Published 2022-07-01 · Updated 2025-09-19

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions git-clone versions all

Description The issue is related to Command Injection due to insecure usage of the --upload-pack feature of git. This affects all versions of the git-clone package.

Recommendations For all versions, consider disabling the --upload-pack feature until a patch is available. Restrict access to the git-clone package to minimize the risk of exploitation. Avoid using the --upload-pack feature in the affected git command until the issue is resolved.

Exploit

Fix

Argument Injection

Command Injection

Weakness Enumeration

CWE-88

CWE-77

Related Identifiers

CVE-2022-25900

GHSA-8JMW-WJR8-2X66

SNYK-JS-GITCLONE-2434308

Affected Products

Git-Clone

References · 10

• 🔥 https://snyk.io/vuln/SNYK-JS-GITCLONE-2434308 · Exploit
• 🔥 https://gist.github.com/lirantal/9441f3a1212728476f7a6caa4acb2ccc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25900 · Security Note
• https://osv.dev/vulnerability/GHSA-8jmw-wjr8-2x66 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25900 · Vendor Advisory
• https://github.com/jaz303/git-clone/commit/fd330459593aef7c7a8c54d786e3c4d5722749f9 · Note
• https://github.com/jaz303/git-clone · Note
• https://t.me/cibsecurity/45525 · Telegram Post
• https://twitter.com/liran_tal/status/1969027957491400930 · Twitter Post
• https://t.me/cvenotify/32531 · Telegram Post