CVE-2022-24066

Published April 1st, 2022

View on NVD ↗

CVSS v3

8.1

HIGH

CVSS v2

7.5

HIGH

Affected

PROJECT

Description

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.

steveukx/git-js

A light weight interface for running git commands in any node.js application.

GitHub

3.85K