CVE-2022-42906
Powerline Gitstatus vulnerable to arbitrary code execution
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
7.8
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
- Record
CVE-2022-42906- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List
7.8
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
- Record
CVE-2022-42906- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2022-7172
7.8
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
- Record
EUVD-2022-7172- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w67g-6gjv-c599
7.8
Powerline Gitstatus vulnerable to arbitrary code execution
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
- Record
GHSA-w67g-6gjv-c599- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-77, CWE-94
- Updated
- 2026-11-02
OSV
7.8
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
- Record
CVE-2022-42906- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-w67g-6gjv-c599
7.8
Powerline Gitstatus vulnerable to arbitrary code execution
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
- Record
GHSA-w67g-6gjv-c599- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-77, CWE-94
- Updated
- 2026-11-02
OSVPYSEC-2026-898
7.8
Powerline Gitstatus vulnerable to arbitrary code execution
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
- Record
PYSEC-2026-898- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-42906
7.8
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
- Record
UBUNTU-CVE-2022-42906- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-42906 No score
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
- Record
DEBIAN-CVE-2022-42906- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
powerline-gitstatusPyPI |
before 1.3.2 | 1.3.2 |
powerline-gitstatusDebian:12 |
before 1.3.2-1 | 1.3.2-1 |
powerline-gitstatusDebian:13 |
before 1.3.2-1 | 1.3.2-1 |
powerline-gitstatusDebian:14 |
before 1.3.2-1 | 1.3.2-1 |
powerline-gitstatusDebian:10 |
before 1.3.2-0+deb10u1, plus listed versions 1.3.1-11.3.1-21.3.1-31.3.1-4 |
1.3.2-0+deb10u1 |
powerline-gitstatusPyPI |
before 1.3.2, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 6 moreShow less1.1.01.1.11.2.01.2.11.3.01.3.1 |
1.3.2 |
powerline-gitstatusUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.1-1 |
None known |
powerline-gitstatusUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.1-21.3.1-3 |
None known |
powerline-gitstatusUbuntu:24.04:LTS |
All versions, plus listed versions 1.3.2-1 |
None known |
powerline-gitstatusUbuntu:25.10 |
All versions, plus listed versions 1.3.3-1 |
None known |
powerline-gitstatusUbuntu:26.10 |
All versions, plus listed versions 1.3.3-1build1 |
None known |
powerline-gitstatusUbuntu:26.04:LTS |
All versions, plus listed versions 1.3.3-11.3.3-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-42906 is a high vulnerability (CVSS 7.8) in Powerline Gitstatus Project Gitstatus, published October 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in powerline-gitstatus 1.3.2.
References
github.com/jaspernbrouwer/powerline-gitstatus/issues/45
github.com/jaspernbrouwer/powerline-gitstatus/releases/tag/v1.3.2
lists.debian.org/debian-lts-announce/2023/01/msg00017.html
nvd.nist.gov/vuln/detail/CVE-2022-42906
github.com/jaspernbrouwer/powerline-gitstatus/commit/fe8e963b3489e4cceaa2c1f26f2bcc2ef405364c
github.com/advisories/GHSA-w67g-6gjv-c599
Show 7 moreShow less
github.com/CVEProject/cvelistV5/tree/main/cves/2022/42xxx/CVE-2022-42906.json
security-tracker.debian.org/tracker/CVE-2022-42906
github.com/jaspernbrouwer/powerline-gitstatus
pypi.org/project/powerline-gitstatus
ubuntu.com/security/CVE-2022-42906
github.com/jaspernbrouwer/powerline-gitstatus/pull/46
cve.org/CVERecord?id=CVE-2022-42906