CVE-2022-25912
Published: 06 December 2022
Summary
CVE-2022-25912 is a high-severity OS Command Injection (CWE-78) vulnerability in Simple-Git Project Simple-Git. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 3.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The package simple-git before version 3.15.0 is vulnerable to remote code execution when the ext transport protocol is enabled, making the issue exploitable via the clone method. The flaw is an incomplete remediation of the earlier CVE-2022-24066 and is tracked under CWE-78 with a CVSS 3.1 score of 8.1.
An unauthenticated attacker can supply a crafted repository URL that triggers the ext protocol during a clone operation, resulting in arbitrary command execution on the host with impacts to confidentiality, integrity, and availability.
Public references direct users to upgrade to simple-git 3.15.0, which contains the fixing commit, and point to project documentation that explains how to override the list of allowed protocols to reduce exposure.
The EPSS probability rose from a low baseline to a peak of 0.6020 on 2026-03-12 before receding to the current value of 0.2773, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-7586
Vulnerability details
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.