Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/czproject/git-php@4.0.3
purl pkg:composer/czproject/git-php@4.0.3
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-eb65-qkza-w7hc Command injection in czproject/git-php The package czproject/git-php before 4.0.3 is vulnerable to Command Injection via git argument injection. When calling the `isRemoteUrlReadable($url, array $refs = NULL)` function, both the url and refs parameters are passed to the `git ls-remote` subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection. CVE-2022-25866
GHSA-3xpw-vhmv-cw7h

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-05T21:22:23.080464+00:00 GHSA Importer Fixing VCID-eb65-qkza-w7hc https://github.com/advisories/GHSA-3xpw-vhmv-cw7h 38.6.0
2026-06-04T17:44:44.766917+00:00 GithubOSV Importer Fixing VCID-eb65-qkza-w7hc https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-3xpw-vhmv-cw7h/GHSA-3xpw-vhmv-cw7h.json 38.6.0
2026-06-02T04:42:08.737386+00:00 GitLab Importer Fixing VCID-eb65-qkza-w7hc https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/czproject/git-php/CVE-2022-25866.yml 38.6.0