Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-2x3q-pntk-jqcs
Vulnerability ID VCID-2x3q-pntk-jqcs
Aliases CVE-2022-25912
GHSA-9p95-fxvg-qgq2
Summary The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.27728 https://api.first.org/data/v1/epss?cve=CVE-2022-25912
epss 0.27728 https://api.first.org/data/v1/epss?cve=CVE-2022-25912
epss 0.27728 https://api.first.org/data/v1/epss?cve=CVE-2022-25912
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-9p95-fxvg-qgq2
cvssv3.1 8.1 https://github.com/steveukx/git-js
generic_textual HIGH https://github.com/steveukx/git-js
cvssv3.1 8.1 https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols
cvssv3.1 8.1 https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols
generic_textual HIGH https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols
ssvc Track* https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols
cvssv3.1 8.1 https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504
cvssv3.1 8.1 https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504
generic_textual HIGH https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504
ssvc Track* https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504
cvssv3.1 8.1 https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0
cvssv3.1 8.1 https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0
generic_textual HIGH https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0
ssvc Track* https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2022-25912
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-25912
cvssv3.1 8.1 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
cvssv3.1 8.1 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
generic_textual HIGH https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
ssvc Track* https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
cvssv3.1 8.1 https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221
cvssv3.1 8.1 https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221
generic_textual HIGH https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221
ssvc Track* https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-25912
https://github.com/steveukx/git-js
774648049eb3e628379e292ea172dccaba610504 https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504
CVE-2022-25912 https://nvd.nist.gov/vuln/detail/CVE-2022-25912
GHSA-9p95-fxvg-qgq2 https://github.com/advisories/GHSA-9p95-fxvg-qgq2
PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols
simple-git%403.15.0 https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0
SNYK-JAVA-ORGWEBJARSNPM-3153532 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
SNYK-JS-SIMPLEGIT-3112221 https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/steveukx/git-js
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-22T20:14:53Z/ Found at https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-22T20:14:53Z/ Found at https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-22T20:14:53Z/ Found at https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-25912
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-22T20:14:53Z/ Found at https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-22T20:14:53Z/ Found at https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221
Exploit Prediction Scoring System (EPSS)
Percentile 0.9656
EPSS Score 0.27728
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:36:14.530104+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2022/25xxx/CVE-2022-25912.json 38.6.0