Lucene search

Veracode Vulnerability DatabaseVERACODE:39165

HistoryFeb 08, 2023 - 9:25 a.m.

Remote Code Execution (RCE)

2023-02-0809:25:23

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

remote code execution

simple-git

vulnerability

improper sanitization

clone

pull

push

listremote

arbitrary code

0.021 Low

EPSS

Percentile

89.2%

JSON

simple-git is vulnerable to Remote Code Execution (RCE). The vulnerability exists due to improper sanitization of the clone(), pull(), push() and listRemote() methods which allows an attacker to execute arbitrary code.

CPENameOperatorVersion
simple-gitle3.15.1
simple-gitle3.15.1

CPE	Name	Operator	Version
	simple-git	le	3.15.1
	simple-git	le	3.15.1

References

github.com/advisories/GHSA-9w5j-4mwv-2wj8

github.com/steveukx/git-js/commit/ec97a39ab60b89e870c5170121cd9c1603cc1951

github.com/steveukx/git-js/pull/881

github.com/steveukx/git-js/pull/881/commits/95459310e5b8f96e20bb77ef1a6559036b779e13

github.com/steveukx/git-js/pull/882

0.021 Low

EPSS

Percentile

89.2%

JSON

Related for VERACODE:39165