{"id":"CVE-2022-41942","aliases":["EUVD-2022-45053"],"status":"published","title":"Sourcegraph vulnerable to Comand Injection via gitserver","description":"Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.","severity":{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02833,"percentile":0.86747,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-78"],"published":"2022-11-22T00:00:00Z","modified":"2026-06-17T05:04:06Z","products":[{"vendor":"sourcegraph","product":"sourcegraph"}],"references":[{"url":"https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-pfm3-23mh-6xjp","tags":["x_transferred","Third Party Advisory"]},{"url":"https://github.com/sourcegraph/sourcegraph/pull/42553","tags":["x_transferred","Patch","Third Party Advisory"]}],"sources":{"cve":[{"id":"CVE-2022-41942","title":"Sourcegraph vulnerable to Comand Injection via gitserver","description":"Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.","status":"published","published":"2022-11-22T00:00:00Z","modified":"2025-04-23T16:36:07.093Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-78"],"updated_at":"2026-11-02T14:34:27.640972Z"}],"euvd":[{"id":"EUVD-2022-45053","description":"Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.","status":"published","published":"2022-11-22T00:00:00Z","modified":"2025-04-23T16:36:07Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T20:52:12.313971Z"}],"nvd":[{"id":"CVE-2022-41942","description":"Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.","status":"published","published":"2022-11-22T19:15:18.017Z","modified":"2026-06-17T05:04:06.423Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-78"],"updated_at":"2026-11-02T14:07:32.395456Z"}]}}