Search for packages
| purl | pkg:gem/git@1.0.4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-56kh-cvav-7ua2
Aliases: CVE-2022-47318 GHSA-pphf-gfrm-v32r |
Improper Control of Generation of Code ('Code Injection') ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648. |
Affected by 0 other vulnerabilities. |
|
VCID-sbpw-p6f8-3qgs
Aliases: CVE-2022-25648 GHSA-69p6-wvmq-27gg |
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') The package git before 1.11.0 is vulnerable to Command Injection via git argument injection. When calling the `fetch(remote = 'origin', opts = {})` function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-06T03:23:39.865704+00:00 | GitLab Importer | Affected by | VCID-56kh-cvav-7ua2 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/git/CVE-2022-47318.yml | 38.6.0 |
| 2026-06-06T01:41:19.367188+00:00 | GitLab Importer | Affected by | VCID-sbpw-p6f8-3qgs | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/git/CVE-2022-25648.yml | 38.6.0 |