PT-2022-26656 · Unknown · Powerline-Gitstatus

Jcharaoui + 1 · Published 2022-10-13 · Updated 2025-05-15 · CVE-2022-42906

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions powerline-gitstatus versions prior to 1.3.2

Description The issue allows for arbitrary code execution. Git repositories can contain configuration that alters git behavior, including running arbitrary commands. When using the affected software, changing to a directory automatically runs git commands to display repository information in the prompt. An attacker can exploit this by convincing a user to change their directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, allowing the attacker to run arbitrary commands.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of powerline-gitstatus in untrusted directories to minimize the risk of exploitation. Avoid using powerline-gitstatus in directories that may be controlled by an attacker until the issue is resolved.

Exploit

Fix

Code Injection

Command Injection

Weakness Enumeration

CWE-94

CWE-77

Related Identifiers

CVE-2022-42906

DLA-3277-1

GHSA-W67G-6GJV-C599

Affected Products

Powerline-Gitstatus

References · 17

• 🔥 https://github.com/jaspernbrouwer/powerline-gitstatus/issues/45 · Exploit
• https://ubuntu.com/security/CVE-2022-42906 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-42906 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-42906 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-42906 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-42906 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w67g-6gjv-c599 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3277-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-42906 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-42906 · Vendor Advisory
• https://github.com/jaspernbrouwer/powerline-gitstatus · Note
• https://github.com/jaspernbrouwer/powerline-gitstatus/pull/46 · Note
• https://github.com/jaspernbrouwer/powerline-gitstatus/commit/fe8e963b3489e4cceaa2c1f26f2bcc2ef405364c · Note
• https://github.com/jaspernbrouwer/powerline-gitstatus/releases/tag/v1.3.2 · Note
• https://t.me/cibsecurity/51304 · Telegram Post