Search for packages
| purl | pkg:npm/simple-git@1.101.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-aay3-4t59-pqe8
Aliases: CVE-2022-25912 GHSA-9p95-fxvg-qgq2 |
simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol The package simple-git before 3.15.0 is vulnerable to Remote Code Execution (RCE) when enabling the `ext` transport protocol, which makes it exploitable via `clone()` method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306). |
Affected by 4 other vulnerabilities. |
|
VCID-gtcg-eu7c-p7e6
Aliases: CVE-2026-6951 GHSA-hffm-xvc3-vprc |
simple-git: simple-git: Remote Code Execution due to incomplete fix bypass |
Affected by 0 other vulnerabilities. |
|
VCID-jghj-d43k-h7h4
Aliases: CVE-2026-28291 GHSA-jcxm-m3jx-f287 |
simple-git: simple-git: Command Execution via Option-Parsing Bypass in simple-git |
Affected by 2 other vulnerabilities. |
|
VCID-mmws-zvx3-ebgm
Aliases: CVE-2022-24066 GHSA-28xr-mwxg-3qc8 |
Improper Neutralization of Special Elements used in a Command ('Command Injection') The package simple-git before 3.5.0 is vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover. |
Affected by 4 other vulnerabilities. |
|
VCID-vm66-yukk-qfcs
Aliases: CVE-2022-25860 GHSA-9w5j-4mwv-2wj8 |
Remote code execution in simple-git Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of CVE-2022-25912. |
Affected by 3 other vulnerabilities. |
|
VCID-ztn5-rrz1-n7ed
Aliases: CVE-2022-24433 GHSA-3f95-r44v-8mrg |
Improper Neutralization of Special Elements used in a Command ('Command Injection') The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution. |
Affected by 5 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||