CVE-2022-25860

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jan 26, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-258627.5This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusingCVE-2022-258639.8The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing iCVE-2022-258647.8Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalaCVE-2022-258659.8The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranchCVE-2022-258669.8The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadaCVE-2022-258677.5The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payloCVE-2022-258696.1All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to CroCVE-2022-25879.8Out of bounds write in Chrome OS Audio Server in Google Chrome on Chrome OS prior to 102.0.5005.125 allowed a remote attacker to potentiallyCVE-2022-258717.5All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can beCVE-2022-258725.3All versions of package fast-string-search are vulnerable to Out-of-bounds Read due to incorrect memory freeing and length calculation for aCVE-2022-258735.4The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in tCVE-2022-258756.1The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of a