PT-2022-17600 · Unknown · Simple-Git

Sam Wheating · Published 2022-12-06 · Updated 2026-05-18 · CVE-2022-25912

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions simple-git versions prior to 3.15.0

Description The issue allows for Remote Code Execution (RCE) when the ext transport protocol is enabled, making it exploitable via the clone() method. This is due to an incomplete fix of a previous issue.

Recommendations For versions prior to 3.15.0, update to version 3.15.0 or later to resolve the issue. As a temporary workaround, consider disabling the ext transport protocol to minimize the risk of exploitation. Restrict access to the clone() method until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-25912

GHSA-9P95-FXVG-QGQ2

Affected Products

Simple-Git

References · 20

• 🔥 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221 · Exploit
• https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-25912 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25912 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9p95-fxvg-qgq2 · Vendor Advisory
• https://github.com/steveukx/git-js · Note
• https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols · Note
• https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0 · Note
• https://t.me/cvenotify/117224 · Telegram Post
• https://t.me/cveNotify/163886 · Telegram Post
• https://t.me/cvenotify/119461 · Telegram Post
• https://twitter.com/envconfig/status/2048317098951094418 · Twitter Post
• https://t.me/cvenotify/39229 · Telegram Post
• https://t.me/cvenotify/39359 · Telegram Post