CVE-2022-25912
Remote Code Execution (RCE)
CRITICAL 9.8EPSS 3.1%
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).
- Affected
- simple-git
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 SNYK
- 8.1 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 3.08% chance of exploitation in the next 30 days, 87th percentile
- Published
- 2022-12-12
- Updated
- 2025-04-22
Proof-of-concept exploits (3)
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
- https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221
- Chinuaoku/FormulaX-XSS-RCE4★ · 2024-07-24