{"id":"CVE-2022-25860","aliases":["EUVD-2023-0435","GHSA-9w5j-4mwv-2wj8"],"status":"published","title":"Remote code execution in simple-git","description":"Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization.\rThis vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02828,"percentile":0.86706,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78","CWE-94"],"published":"2023-01-24T05:00:02Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"npm","package":"simple-git","fixed_in":["3.16.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"simple-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0"}]}]},{"source":"osv","ecosystem":"npm","package":"simple-git","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.16.0"}]}]}],"products":[{"vendor":"simple-git_project","product":"simple-git"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3177391","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/steveukx/git-js/pull/881/commits/95459310e5b8f96e20bb77ef1a6559036b779e13","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://github.com/steveukx/git-js/commit/ec97a39ab60b89e870c5170121cd9c1603cc1951","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25860","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9w5j-4mwv-2wj8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25860.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-25860","description":"Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization.\rThis vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).\r\r","status":"published","published":"2023-01-24T05:00:02.399Z","modified":"2025-04-01T15:29:18.377Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"high","assessor":"cna"}],"cwes":["CWE-94","CWE-78"],"updated_at":"2026-11-02T14:34:28.707644Z"}],"euvd":[{"id":"EUVD-2023-0435","description":"Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization.\rThis vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).\r\r","status":"published","published":"2023-01-24T05:00:02Z","modified":"2025-04-01T15:29:18Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"high"}],"updated_at":"2026-11-02T20:52:45.339497Z"}],"ghsa":[{"id":"GHSA-9w5j-4mwv-2wj8","title":"Remote code execution in simple-git","description":"Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of CVE-2022-25912.","status":"published","published":"2023-01-26T21:30:25Z","modified":"2025-04-01T23:03:12Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78","CWE-94"],"updated_at":"2026-11-02T14:38:37.325334Z"}],"nvd":[{"id":"CVE-2022-25860","description":"Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization.\rThis vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).\r\r","status":"published","published":"2023-01-26T21:15:31.073Z","modified":"2026-06-17T04:34:24.36Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-94","CWE-78"],"updated_at":"2026-11-02T14:07:35.561816Z"}],"osv":[{"id":"CVE-2022-25860","description":"Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization.\rThis vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).\r\r","status":"published","published":"2023-01-24T05:00:02.399Z","modified":"2026-10-28T02:31:12.327753046Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"GHSA-9w5j-4mwv-2wj8","title":"Remote code execution in simple-git","description":"Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of CVE-2022-25912.","status":"published","published":"2023-01-26T21:30:25Z","modified":"2025-04-01T23:03:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78","CWE-94"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}