Critical severity · published Dec 6, 2022
CVE-2022-25912
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method
9.8
CVSS
3.1%
EPSS
No
On KEV
Description
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Simple-git · Simple-git Project
before 3.15.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-25912
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-25912
Broken Link
https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols
Patch
https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504
Release Notes
https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0
Exploit
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
Exploit
https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221
More from Simple-git
9.8
CVE-2026-102828
simple-git unsafe-operation guard does not block trailer command configuration
9.8
CVE-2026-102827
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
9.8
CVE-2026-6951
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for…
9.8
CVE-2026-28292
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE
9.8
CVE-2022-25860
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input…