Simple Git Project
Monthly
Command injection in the simple-git Node.js library (versions 3.15.0 through 4.0.0) allows remote, unauthenticated attackers to execute arbitrary shell commands under the identity of the Node.js process when a host application forwards attacker-controlled values into SimpleGitOptions.config or inline -c arguments and later runs git interpret-trailers, because the default blockUnsafeOperationsPlugin does not flag trailer.<token>.cmd (or trailer.<token>.command) as unsafe configuration. This is CWE-78 (OS command injection), rated 9.2 under CVSS v4.0 by the reporter and independently assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; exploitation is contingent on the application actually passing untrusted config into simple-git, so apps using only hard-coded/trusted configuration are not exposed and no privilege escalation beyond the Node process is possible. A vendor-released patch is available in simple-git 4.0.1, which introduces the allowUnsafeCommandBinaries category; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Command injection in simple-git, the Node.js library for running git commands and published on npm, affects all releases before 4.0.0 and allows unauthenticated remote attackers to execute arbitrary commands whenever a consuming application forwards attacker-influenced values into a git push argument list. The library's default blockUnsafeOperationsPlugin matches dangerous options by literal spelling only, so unambiguous Git long-option abbreviations such as --receive-p, --receive-pa and --exe bypass detection, are expanded by Git itself, and reach --receive-pack on a local or file remote where the injected command runs. Publicly available exploit code exists (a published gist plus the detailed upstream advisory proof of concept), but there is no CISA KEV confirmation of active exploitation; EPSS is 0.36% (28th percentile) and SSVC marks the issue Exploitation: none, Automatable: no, because three consumer-specific preconditions must coincide.
Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary commands with the privileges of the Node.js process. The default blockUnsafeOperationsPlugin failed to classify include.path inside customArgs passed to git.clone(), and the initial remediation also missed includeIf.<condition>.path, so a loaded config file could set an executable option such as core.sshCommand that Git runs during the clone. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) but requires both attacker-influenced customArgs reaching git.clone() and an attacker-controlled file already readable by the Node.js process; no public exploit was identified at time of analysis and the issue is fixed in simple-git 4.0.0.
simple-git Node.js library has a command injection vulnerability (EPSS with patch) enabling RCE when processing untrusted git operations.
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Command injection in the simple-git Node.js library (versions 3.15.0 through 4.0.0) allows remote, unauthenticated attackers to execute arbitrary shell commands under the identity of the Node.js process when a host application forwards attacker-controlled values into SimpleGitOptions.config or inline -c arguments and later runs git interpret-trailers, because the default blockUnsafeOperationsPlugin does not flag trailer.<token>.cmd (or trailer.<token>.command) as unsafe configuration. This is CWE-78 (OS command injection), rated 9.2 under CVSS v4.0 by the reporter and independently assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; exploitation is contingent on the application actually passing untrusted config into simple-git, so apps using only hard-coded/trusted configuration are not exposed and no privilege escalation beyond the Node process is possible. A vendor-released patch is available in simple-git 4.0.1, which introduces the allowUnsafeCommandBinaries category; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Command injection in simple-git, the Node.js library for running git commands and published on npm, affects all releases before 4.0.0 and allows unauthenticated remote attackers to execute arbitrary commands whenever a consuming application forwards attacker-influenced values into a git push argument list. The library's default blockUnsafeOperationsPlugin matches dangerous options by literal spelling only, so unambiguous Git long-option abbreviations such as --receive-p, --receive-pa and --exe bypass detection, are expanded by Git itself, and reach --receive-pack on a local or file remote where the injected command runs. Publicly available exploit code exists (a published gist plus the detailed upstream advisory proof of concept), but there is no CISA KEV confirmation of active exploitation; EPSS is 0.36% (28th percentile) and SSVC marks the issue Exploitation: none, Automatable: no, because three consumer-specific preconditions must coincide.
Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary commands with the privileges of the Node.js process. The default blockUnsafeOperationsPlugin failed to classify include.path inside customArgs passed to git.clone(), and the initial remediation also missed includeIf.<condition>.path, so a loaded config file could set an executable option such as core.sshCommand that Git runs during the clone. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) but requires both attacker-influenced customArgs reaching git.clone() and an attacker-controlled file already readable by the Node.js process; no public exploit was identified at time of analysis and the issue is fixed in simple-git 4.0.0.
simple-git Node.js library has a command injection vulnerability (EPSS with patch) enabling RCE when processing untrusted git operations.
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.