{"id":"CVE-2022-25912","aliases":["EUVD-2022-7586","GHSA-9p95-fxvg-qgq2"],"status":"published","title":"Remote Code Execution (RCE)","description":"The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03077,"percentile":0.8776,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2022-12-06T05:15:11.57Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"npm","package":"simple-git","fixed_in":["3.15.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"simple-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0"}]}]},{"source":"osv","ecosystem":"npm","package":"simple-git","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.15.0"}]}]}],"products":[{"vendor":"simple-git_project","product":"simple-git"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0","tags":["x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols","tags":["x_transferred","Broken Link","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25912","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9p95-fxvg-qgq2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25912.json","tags":["advisory"]},{"url":"https://github.com/steveukx/git-js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-25912","title":"Remote Code Execution (RCE)","description":"The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).","status":"published","published":"2022-12-12T01:49:10.008Z","modified":"2025-04-22T20:15:14.996Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:28.374916Z"}],"euvd":[{"id":"EUVD-2022-7586","description":"The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).","status":"published","published":"2022-12-12T01:49:10Z","modified":"2025-04-22T20:15:14Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"high"}],"updated_at":"2026-11-02T20:52:14.528239Z"}],"ghsa":[{"id":"GHSA-9p95-fxvg-qgq2","title":"simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol","description":"The package simple-git before 3.15.0 is vulnerable to Remote Code Execution (RCE) when enabling the `ext` transport protocol, which makes it exploitable via `clone()` method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).","status":"published","published":"2022-12-06T06:30:17Z","modified":"2023-08-17T05:02:31Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:37:00.074932Z"}],"nvd":[{"id":"CVE-2022-25912","description":"The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).","status":"published","published":"2022-12-06T05:15:11.57Z","modified":"2026-06-17T04:34:29.01Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:33.239526Z"}],"osv":[{"id":"CVE-2022-25912","title":"Remote Code Execution (RCE)","description":"The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).","status":"published","published":"2022-12-06T05:15:11.57Z","modified":"2026-10-28T02:31:05.229469344Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"high"}],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"GHSA-9p95-fxvg-qgq2","title":"simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol","description":"The package simple-git before 3.15.0 is vulnerable to Remote Code Execution (RCE) when enabling the `ext` transport protocol, which makes it exploitable via `clone()` method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).","status":"published","published":"2022-12-06T06:30:17Z","modified":"2023-11-08T04:08:51.887503Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:43.875515Z"}]}}