Read the docs
TI-2022-07694 Aliases CVE-2022-23642

Code Injection in Sourcegraph

Priority HIGH 79CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94 and CWE-862.

Summary

Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option, which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround, ensure that requests to gitserver are properly protected.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.7431 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed sourcegraph (sourcegraph): 3.37

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sourcegraphsourcegraphbefore 3.373.37Patch availableCNA
  • sourcegraph Vendorsourcegraph Affected before 3.37 Fixed in 3.37 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sourcegraph:sourcegraph:*:*:*:*:*:*:*:*before 3.37Vulnerablesourcegraph
  • cpe:2.3:a:sourcegraph:sourcegraph:*:*:*:*:*:*:*:* Versions before 3.37 Vulnerable ·sourcegraph

Remediation

  • Fix · CNA sourcegraph (sourcegraph) Fixed in 3.37

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23642

References

Exploit 2

Patch 2

  • TI-2022-20284 Incorrect default permissions found in Sourcegraph CVSS 3.1CRITICAL 9.0
  • TI-2022-20283 Sourcegraph vulnerable to Comand Injection via gitserver CVSS 3.1HIGH 7.9
  • TI-2022-11715 Remote Code Execution in sourcegraph CVSS 3.1HIGH 7.2
  • TI-2022-07695 Side-channel attack in Sourcegraph Code Monitors CVSS 3.1MEDIUM 6.5
  • TI-2021-19629 Side-channel attack in Sourcegraph CVSS 3.1MEDIUM 6.5
  • TI-2020-09815 Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper… CVSS 3.1MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences