CVE-2022-1440

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
yarkeev	yarkeev/git-interface	>= unspecified, < 2.1.2

References

https://github.com/yarkeev/git-interface/commit/f828aa790016fee3aa667f7b44cf94bf0aa8c60dPatch, Third Party Advisory
https://huntr.dev/bounties/cdc25408-d3c1-4a9d-bb45-33b12a715ca1Exploit, Mitigation, Third Party Advisory
https://github.com/yarkeev/git-interface/commit/f828aa790016fee3aa667f7b44cf94bf0aa8c60dPatch, Third Party Advisory
https://huntr.dev/bounties/cdc25408-d3c1-4a9d-bb45-33b12a715ca1Exploit, Mitigation, Third Party Advisory

Timeline

Published: Apr 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-14417.8MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it cal CVE-2022-14427.5The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php CVE-2022-14445.5heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is capable of inducing denial of service.CVE-2022-14455.4Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerabil CVE-2022-14517.1Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the CVE-2022-14527.1Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes t CVE-2022-14537.5The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user s CVE-2022-14556.1The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, l CVE-2022-14564.8The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admi CVE-2022-14575.4Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. CVE-2022-14585.4Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1.CVE-2022-14598.3Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1.