CVE-2022-24066

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published
Apr 1, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-240698.2An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.0 before 05.08.41, 5.1 before 05.16.29, 5.2 before 05.26.29, 5.3 befCVE-2022-24074.8The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as adminCVE-2022-240707.5Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempCVE-2022-240714.3A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controllinCVE-2022-240726.1The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store weCVE-2022-240737.1The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users acceCVE-2022-240749.8Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itCVE-2022-240756.5Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP fiCVE-2022-240777.8Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection.CVE-2022-24084.3The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fCVE-2022-240829.8If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filterCVE-2022-240839.8Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.