{"id":"CVE-2022-24066","aliases":["EUVD-2022-1593","GHSA-28xr-mwxg-3qc8"],"status":"published","title":"Command Injection","description":"The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.03896,"percentile":0.90392,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-88"],"published":"2022-04-01T20:00:16Z","modified":"2026-10-28T02:31:11Z","fixes":[{"ecosystem":"npm","package":"simple-git","fixed_in":["3.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"simple-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0"}]}]},{"source":"osv","ecosystem":"npm","package":"simple-git","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.5.0"}]}]}],"products":[{"vendor":"simple-git_project","product":"simple-git"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","web"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2434820","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","web"]},{"url":"https://gist.github.com/lirantal/a930d902294b833514e821102316426b","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/steveukx/git-js/commit/2040de601c894363050fef9f28af367b169a56c5","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24066","tags":["advisory"]},{"url":"https://github.com/steveukx/git-js/releases/tag/simple-git%403.5.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-28xr-mwxg-3qc8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24066.json","tags":["advisory"]},{"url":"https://github.com/steveukx/git-js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-24066","title":"Command Injection","description":"The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.","status":"published","published":"2022-04-01T20:00:16.93Z","modified":"2024-09-16T21:08:34.077Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:34:34.940806Z"}],"euvd":[{"id":"EUVD-2022-1593","description":"The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.","status":"published","published":"2022-04-01T20:00:16Z","modified":"2024-09-16T21:08:34Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:07.646084Z"}],"ghsa":[{"id":"GHSA-28xr-mwxg-3qc8","title":"Command injection in simple-git","description":"`simple-git` (maintained as [git-js](https://github.com/steveukx/git-js) named repository on GitHub) is a light weight interface for running git commands in any node.js application.The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover. A fix was released in simple-git@3.5.0.","status":"published","published":"2022-04-02T00:00:13Z","modified":"2023-08-17T05:02:41Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:37:00.074932Z"}],"nvd":[{"id":"CVE-2022-24066","description":"The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.","status":"published","published":"2022-04-01T20:15:08.113Z","modified":"2026-06-17T04:31:14.78Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:07:14.706146Z"}],"osv":[{"id":"CVE-2022-24066","title":"Command Injection","description":"The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.","status":"published","published":"2022-04-01T20:00:16.93Z","modified":"2026-10-28T02:31:11.780900785Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"GHSA-28xr-mwxg-3qc8","title":"Command injection in simple-git","description":"`simple-git` (maintained as [git-js](https://github.com/steveukx/git-js) named repository on GitHub) is a light weight interface for running git commands in any node.js application.The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover. A fix was released in simple-git@3.5.0.","status":"published","published":"2022-04-02T00:00:13Z","modified":"2025-01-14T10:57:24.83729Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:46:33.956911Z"}]}}