CVE-2022-24433

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-244347.5This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attack CVE-2022-244356.1Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script vi CVE-2022-244366.5Observable behavioral in power management throttling for some Intel(R) Processors may allow an authenticated user to potentially enable info CVE-2022-244379.8The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is a CVE-2022-244399.8All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possib CVE-2022-24448.8The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 're CVE-2022-244409.8The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. W CVE-2022-244418.8The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a ma CVE-2022-244429.8JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.CVE-2022-244446.5Silverstripe silverstripe/framework through 4.10 allows Session Fixation.CVE-2022-244464.3An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user info CVE-2022-244476.5An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the leve