{"id":"CVE-2022-25912","published":"2022-12-12T01:49:10Z","modified":"2025-04-22T20:15:14Z","title":"Remote Code Execution (RCE)","vendor":null,"product":null,"tier":"tail","description":{"text":"The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).","provenance":"source","from":"CVE.org"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03077,"percentile":0.87669,"provenance":"source"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221","tags":[]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532","tags":[]},{"url":"https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504","tags":[]},{"url":"https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0","tags":[]},{"url":"https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols","tags":[]}],"priority":{"score":23.2,"factors":[{"name":"EPSS percentile","points":17.53},{"name":"CVSS severity","points":5.67}]},"affectedVersions":[{"vendor":"n/a","product":"simple-git","versions":[">= unspecified, < 3.15.0"]}],"affected":[{"ecosystem":"npm","package":"simple-git","vulnerableRanges":["<3.15.0"],"patched":["3.15.0"],"from":["GHSA-9p95-fxvg-qgq2"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7586","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-steveukx-simple-git-cve-2022-24433","parents":[{"from":"CVE-2022-24066","to":"CVE-2022-25912","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This vulnerability exists due to an incomplete fix of CVE-2022-24066.","from":"CVE.org","in":"CVE-2022-25912"},{"kind":"version-step","provenance":"source","package":"npm:simple-git","fromFixed":"3.5.0","toFixed":"3.15.0","daysApart":255},{"kind":"similar","provenance":"machine","score":0.63,"basis":"same package + description similarity"}]}],"children":[{"from":"CVE-2022-25912","to":"CVE-2022-25860","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This vulnerability exists due to an incomplete fix of CVE-2022-25912.","from":"CVE.org","in":"CVE-2022-25860"},{"kind":"version-step","provenance":"source","package":"npm:simple-git","fromFixed":"3.15.0","toFixed":"3.16.0","daysApart":43},{"kind":"similar","provenance":"machine","score":0.67,"basis":"same package + description similarity"}]},{"from":"CVE-2022-25912","to":"CVE-2026-28292","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"…git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine.","from":"CVE.org","in":"CVE-2026-28292"}]},{"from":"CVE-2022-25912","to":"CVE-2026-6951","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for CVE-2022-25912 that blocks the -c option but not the equivalent --config form.","from":"CVE.org","in":"CVE-2026-6951"}]}],"packageHistory":[{"cve":"CVE-2022-24433","published":"2022-03-11","fixed":"3.3.0","kev":false},{"cve":"CVE-2022-24066","published":"2022-04-01","fixed":"3.5.0","kev":false},{"cve":"CVE-2022-25912","published":"2022-12-12","fixed":"3.15.0","kev":false},{"cve":"CVE-2022-25860","published":"2023-01-24","fixed":"3.16.0","kev":false},{"cve":"CVE-2026-28291","published":"2026-04-13","fixed":"3.32.0","kev":false},{"cve":"CVE-2026-28292","published":"2026-03-10","fixed":"3.32.3","kev":false}],"package":"npm:simple-git"}}