CVE-2022-25912 json
Remote Code Execution (RCE)
published 3y ago modified 4mo ago also GHSA-9p95-fxvg-qgq2 , EUVD-2022-7586
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.1%
- EPSS 3.1% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).
Patch / fix
- npm simple-git 3.15.0
- n/a simple-git 3.15.0
Is CVE-2022-25912 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
3.08% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- security.snyk.io https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221 referenced PoC, tagged "exploit" by a source, unverified
- security.snyk.io https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | simple-git | <3.15.0 |
3.15.0 |
Affected products
- n/a simple-git
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504
web, patch, third-party-advisory
-
security.snyk.io
/vuln/SNYK-JS-SIMPLEGIT-3112221
web, exploit, patch, third-party-advisory
-
security.snyk.io
/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
web, exploit, patch, third-party-advisory
-
github.com
/steveukx/git-js/releases/tag/simple-git%403.15.0
web, release-notes, third-party-advisory
-
github.com
/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols
web, broken-link
-
nvd.nist.gov
/vuln/detail/CVE-2022-25912
advisory
-
github.com
/steveukx/git-js
package
Sources
- CVE List CVE-2022-25912
- GitHub Advisory GHSA-9p95-fxvg-qgq2
- NVD CVE-2022-25912
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.