Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:npm/ungit@1.4.32
Typenpm
Namespace
Nameungit
Version1.4.32
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version1.5.20
Latest_non_vulnerable_version1.5.20
Affected_by_vulnerabilities
0
url VCID-8fqs-hx58-rfg7
vulnerability_id VCID-8fqs-hx58-rfg7
summary 
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The package ungit before 1.5.20 is vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the `/api/fetch` endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git options it was possible to get arbitrary command execution.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-25766
reference_id
reference_type
scores
0
value 0.04231
scoring_system epss
scoring_elements 0.8895
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-25766
1
reference_url https://github.com/FredrikNoren/ungit
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FredrikNoren/ungit
2
reference_url https://github.com/FredrikNoren/ungit/blob/master/CHANGELOG.md%231520
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FredrikNoren/ungit/blob/master/CHANGELOG.md%231520
3
reference_url https://github.com/FredrikNoren/ungit/pull/1510
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FredrikNoren/ungit/pull/1510
4
reference_url https://github.com/FredrikNoren/ungit/pull/1511
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FredrikNoren/ungit/pull/1511
5
reference_url https://snyk.io/vuln/SNYK-JS-UNGIT-2414099
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://snyk.io/vuln/SNYK-JS-UNGIT-2414099
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-25766
reference_id CVE-2022-25766
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-25766
7
reference_url https://github.com/advisories/GHSA-hf8c-xr89-vfm5
reference_id GHSA-hf8c-xr89-vfm5
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-hf8c-xr89-vfm5
fixed_packages
0
url pkg:npm/ungit@1.5.20
purl pkg:npm/ungit@1.5.20
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/ungit@1.5.20
aliases CVE-2022-25766, GHSA-hf8c-xr89-vfm5
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8fqs-hx58-rfg7
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:npm/ungit@1.4.32