CVE-2022-24376

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SNYK-JS-GITPROMISE-567476) in this package. **Note:** Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

Vendor	Product	Versions
n/a	git-promise	< unspecified

References

https://gist.github.com/lirantal/9da1fceb32f5279eb76a5fc1cb9707ddExploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-GITPROMISE-2434310Exploit, Third Party Advisory
https://gist.github.com/lirantal/9da1fceb32f5279eb76a5fc1cb9707ddExploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-GITPROMISE-2434310Exploit, Third Party Advisory

Timeline

Published: Jun 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-243779.8The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper CVE-2022-243785.5Improper initialization in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enabl CVE-2022-243796.7Improper input validation in some Intel(R) Server System M70KLP Family BIOS firmware before version 01.04.0029 may allow a privileged user t CVE-2022-24387.2The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to CVE-2022-243817.5All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chu CVE-2022-243826.7Improper input validation in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via l CVE-2022-243837.8The affected product is vulnerable to an out-of-bounds read, which may result in code execution CVE-2022-243846.1Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.CVE-2022-243856.5A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTr CVE-2022-243866.1Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.CVE-2022-243877.2With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsetti CVE-2022-243888.8Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and