simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-25912 · ADVISORY
• steveukx/git-js commit 7746480 · WEB
• steveukx/git-js · PACKAGE
• steveukx/git-js · WEB
• steveukx/git-js release [email protected] · WEB
• security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532 · WEB
• security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221 · WEB

simple-git의 다른 취약점

• CVE-2026-102828심각 9.8simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript…
• CVE-2026-102827심각 9.8simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript…
• CVE-2026-102826높음 8.1simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript…
• CVE-2026-6951심각 9.8Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912]…
• CVE-2026-28291높음 8.1simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands th…