CVE-2022-21687 json
Command injection in gh-ost
published 4y ago modified last mo. also GHSA-rrp4-2xx3-mv29 , GO-2022-0298 , EUVD-2022-1182
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack's malicious MySQL server. The `-database` parameter does not properly sanitize user input which can lead to arbitrary file reads.
Patch / fix
Is CVE-2022-21687 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
1.00% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/github/gh-ost | <1.1.3 |
1.1.3 |
Classification
References
-
github.com
/github/gh-ost/commit/a91ab042de013cfd8fbb633763438932d9080d8f
web, patch, third-party-advisory
-
github.com
/github/gh-ost/security/advisories/GHSA-rrp4-2xx3-mv29
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-21687
advisory
-
github.com
/github/gh-ost
package
Sources
- CVE List CVE-2022-21687
- GitHub Advisory GHSA-rrp4-2xx3-mv29
- NVD CVE-2022-21687
- OSV GO-2022-0298
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.