simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol

CRITICAL 9.8CVE-2022-25912 · GHSA-9p95-fxvg-qgq2 · Published 06/12/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
simple-git simple-git_project	`< 3.15.0`	`3.15.0`
simple-git npm	`< 3.15.0`	`3.15.0`

Description

The package simple-git before 3.15.0 is vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.

NVD description

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).

References

nvd.nist.gov/vuln/detail/CVE-2022-25912 · ADVISORY
steveukx/git-js commit 7746480 · WEB
steveukx/git-js · PACKAGE
steveukx/git-js · WEB
steveukx/git-js release [email protected] · WEB
security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532 · WEB
security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free