Headline
GHSA-9p95-fxvg-qgq2: simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol
The package simple-git before 3.15.0 is vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2022-25912
simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol
High severity GitHub Reviewed Published Dec 6, 2022 • Updated Dec 7, 2022
Package
npm simple-git (npm)
Affected versions
< 3.15.0
Description
Related news
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).