Command injection in git-pull-or-clone
Priority MEDIUM 48CWE-88Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-88.
Summary
The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.
Why it matters now
EPSS 0.03738 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed git-pull-or-clone: 2.0.2git-pull-or-clone (npm): 2.0.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | git-pull-or-clone | before 2.0.2 | 2.0.2 | Patch available | CNA |
| — | git-pull-or-clone (npm) | before 2.0.2 | 2.0.2 | Patch available | GHSA-3x62-x456-q2vm |
- git-pull-or-clone Vendor— Affected before 2.0.2 Fixed in 2.0.2 Patch available CNA
- git-pull-or-clone (npm) Vendor— Affected before 2.0.2 Fixed in 2.0.2 Patch available GHSA-3x62-x456-q2vm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:git-pull-or-clone_project:git-pull-or-clone:*:*:*:*:*:node.js:*:* | before 2.0.2 | Vulnerable | Git-pull-or-clone Project |
- cpe:2.3:a:git-pull-or-clone_project:git-pull-or-clone:*:*:*:*:*:node.js:*:* Versions before 2.0.2 Vulnerable ·Git-pull-or-clone Project
Remediation
- Fix · CNA git-pull-or-clone Fixed in 2.0.2
- Fix · GHSA-3x62-x456-q2vm git-pull-or-clone (npm) Fixed in 2.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24437
- 2026-10-03 Alias added: GHSA-3x62-x456-q2vm
References
Sources
- CVE-2022-24437 · CVE Program
- CVE-2022-24437 · NVD
- FIRST EPSS
- GHSA-3x62-x456-q2vm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences