CVE-2022-42906

powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.

• CWE-77
• CWE-77

• https://github.com/jaspernbrouwer/powerline-gitstatus/issues/45Exploit, Issue Tracking, Third Party Advisory
• https://github.com/jaspernbrouwer/powerline-gitstatus/releases/tag/v1.3.2Release Notes
• https://lists.debian.org/debian-lts-announce/2023/01/msg00017.htmlMailing List, Third Party Advisory
• https://github.com/jaspernbrouwer/powerline-gitstatus/issues/45Exploit, Issue Tracking, Third Party Advisory
• https://github.com/jaspernbrouwer/powerline-gitstatus/releases/tag/v1.3.2Release Notes
• https://lists.debian.org/debian-lts-announce/2023/01/msg00017.htmlMailing List, Third Party Advisory

Published

Oct 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42900Bentley MicroStation and MicroStation-based applications may…7.8
• CVE-2022-42901Bentley MicroStation and MicroStation-based applications may…7.8
• CVE-2022-42902In Linaro Automated Validation Architecture (LAVA) before 20…8.8
• CVE-2022-42903Zoho ManageEngine SupportCenter Plus through 11024 allows lo…3.3
• CVE-2022-42904Zoho ManageEngine ADManager Plus through 7151 allows authent…7.2
• CVE-2022-42905In wolfSSL before 5.5.2, if callback functions are enabled (…9.1
• CVE-2022-42908WEPA Print Away is vulnerable to a stored XSS. It does not p…5.4
• CVE-2022-42909WEPA Print Away does not verify that a user has authorizatio…5.4
• CVE-2022-4291The aswjsflt.dll library from Avast Antivirus windows contai…10
• CVE-2022-42915curl before 7.86.0 has a double free. If curl is told to use…8.1
• CVE-2022-42916In curl before 7.86.0, the HSTS check could be bypassed to t…7.5
• CVE-2022-42919Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux…7.8