CVE-2022-25912

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).

• CWE-78
• CWE-78

• https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocolsBroken Link
• https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504Patch, Third Party Advisory
• https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0Release Notes, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532Exploit, Patch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221Exploit, Patch, Third Party Advisory
• https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocolsBroken Link
• https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504Patch, Third Party Advisory
• https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0Release Notes, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532Exploit, Patch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221Exploit, Patch, Third Party Advisory

Published

Dec 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25905Uncontrolled search path element in the Intel(R) oneAPI Data…7.3
• CVE-2022-25906All versions of the package is-http2 are vulnerable to Comma…7.8
• CVE-2022-25907The package ts-deepmerge before 2.0.2 are vulnerable to Prot…9.8
• CVE-2022-25908All versions of the package create-choo-electron are vulnera…9.8
• CVE-2022-25909Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-2591A vulnerability classified as critical has been found in TEM…7.5
• CVE-2022-25914The package com.google.cloud.tools:jib-core before 0.22.0 ar…9.8
• CVE-2022-25915Improper access control vulnerability in ELECOM LAN routers …8.8
• CVE-2022-25916Versions of the package mt7688-wiscan before 0.8.3 are vulne…7.8
• CVE-2022-25917Uncaught exception in the firmware for some Intel(R) Server …4.4
• CVE-2022-25918The package shescape from 1.5.10 and before 1.6.1 are vulner…7.5
• CVE-2022-2592A lack of length validation in Snippet descriptions in GitLa…6.5