CVE-2022-25912

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	simple-git	>= unspecified, < 3.15.0

References

https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocolsBroken Link
https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504Patch, Third Party Advisory
https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0Release Notes, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532Exploit, Patch, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221Exploit, Patch, Third Party Advisory
https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocolsBroken Link
https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504Patch, Third Party Advisory
https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0Release Notes, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532Exploit, Patch, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221Exploit, Patch, Third Party Advisory

Timeline

Published: Dec 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-259149.8The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution (RCE) via the isDockerInstalled function, CVE-2022-259158.8Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, CVE-2022-259167.8Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.sca CVE-2022-259174.4Uncaught exception in the firmware for some Intel(R) Server Board M50CYP Family before version R01.01.0005 may allow a privileged user to po CVE-2022-259187.5The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in CVE-2022-25926.5A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 pr CVE-2022-259219.8All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function c CVE-2022-259229.1Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 CVE-2022-259239.8Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper u CVE-2022-259267.8Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input san CVE-2022-259277.5Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial CVE-2022-259295.4The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in s