CVE-2022-25648

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

• CWE-88

• https://github.com/ruby-git/ruby-git/pull/569Issue Tracking, Patch
• https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0Release Notes
• https://lists.debian.org/debian-lts-announce/2023/01/msg00043.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTJUF6SFPL4ZVSJQHGQ36KFPFO5DQVYZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q2V3HOFU4ZVTQZHAVAVL3EX2KU53SP7R/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWNJA7WPE67LJ3DJMWZ2TADHCZKWMY55/
• https://snyk.io/vuln/SNYK-RUBY-GIT-2421270Exploit, Patch, Third Party Advisory
• https://github.com/ruby-git/ruby-git/pull/569Issue Tracking, Patch
• https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0Release Notes
• https://lists.debian.org/debian-lts-announce/2023/01/msg00043.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTJUF6SFPL4ZVSJQHGQ36KFPFO5DQVYZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q2V3HOFU4ZVTQZHAVAVL3EX2KU53SP7R/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWNJA7WPE67LJ3DJMWZ2TADHCZKWMY55/
• https://snyk.io/vuln/SNYK-RUBY-GIT-2421270Exploit, Patch, Third Party Advisory

Published

Apr 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25642Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS. A …6.1
• CVE-2022-25643seatd-launch in seatd 0.6.x before 0.6.4 allows removing fil…9.8
• CVE-2022-25644All versions of package @pendo324/get-process-by-name are vu…9.8
• CVE-2022-25645All versions of package dset are vulnerable to Prototype Pol…8.1
• CVE-2022-25646All versions of package x-data-spreadsheet are vulnerable to…6.1
• CVE-2022-25647The package com.google.code.gson:gson before 2.8.9 are vulne…7.5
• CVE-2022-25649Multiple Improper Access Control vulnerabilities in StoreApp…8.8
• CVE-2022-2565The Simple Payment Donations & Subscriptions WordPress plugi…7.2
• CVE-2022-25650A vulnerability has been identified in Mendix Applications u…6.5
• CVE-2022-25651Memory corruption in bluetooth host due to integer overflow …9.8
• CVE-2022-25652Cryptographic issues in BSP due to improper hash verificatio…7.8
• CVE-2022-25653Information disclosure in video due to buffer over-read whil…5.5