Critical severity · published Mar 11, 2022
CVE-2022-24433
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection
9.8
CVSS
3.7%
EPSS
No
On KEV
Description
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Simple-git · Simple-git Project
before 3.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24433
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24433
Patch
https://github.com/steveukx/git-js/pull/767
Patch
https://github.com/steveukx/git-js/releases/tag/simple-git%403.3.0
Patch
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2421245
Patch
https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199
More from Simple-git
9.8
CVE-2026-102828
simple-git unsafe-operation guard does not block trailer command configuration
9.8
CVE-2026-102827
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
9.8
CVE-2026-6951
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for…
9.8
CVE-2026-28292
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE
9.8
CVE-2022-25860
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input…