Simple Git
Approved changes feed: RSS · Atom
cpe:2.3:a:n/a:simple-git:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | N/A (22f567d3-1203-528c-8f0e-3eb9c2f6ca78) |
|---|---|
| Product | Simple Git (3e025a9a-ff8f-58cd-be25-8faf4a03e3ac) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-6951 |
vulnerable | 2026-06-08 08:07:05.199083 |
Details available
CRITICAL (9.8)
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.
Published: 2026-04-25T05:00:05.257Z
Updated: 2026-07-17T15:25:23.580Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25912 |
vulnerable | 2026-06-08 05:41:49.669526 |
Remote Code Execution (RCE)
HIGH (8.1)
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).
Published: 2022-12-12T01:49:10.008Z
Updated: 2025-04-22T20:15:14.996Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25860 |
vulnerable | 2026-06-08 05:41:49.579737 |
Details available
HIGH (8.1)
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization.
This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).
Published: 2023-01-24T05:00:02.399Z
Updated: 2025-04-01T15:29:18.377Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24433 |
vulnerable | 2026-06-08 05:41:00.567279 |
Command Injection
HIGH (8.1)
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.
Published: 2022-03-11T16:15:14.245Z
Updated: 2024-09-16T21:57:22.111Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24066 |
vulnerable | 2026-06-08 05:40:59.564847 |
Command Injection
HIGH (8.1)
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.
Published: 2022-04-01T20:00:16.930Z
Updated: 2024-09-16T21:08:34.077Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.