Read the docs
TI-2022-20283 Aliases CVE-2022-41942

Sourcegraph vulnerable to Comand Injection via gitserver

Priority MEDIUM 42CWE-20Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02833 86th percentileScored 2026-11-07
Fix Fixed sourcegraph (sourcegraph): 4.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sourcegraphsourcegraphbefore 4.1.04.1.0Patch availableCNA
  • sourcegraph Vendorsourcegraph Affected before 4.1.0 Fixed in 4.1.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sourcegraph:sourcegraph:*:*:*:*:*:*:*:*before 4.1.0Vulnerablesourcegraph
  • cpe:2.3:a:sourcegraph:sourcegraph:*:*:*:*:*:*:*:* Versions before 4.1.0 Vulnerable ·sourcegraph

Remediation

  • Fix · CNA sourcegraph (sourcegraph) Fixed in 4.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41942

References

Patch 1

Advisory 1

  • TI-2022-07694 Code Injection in Sourcegraph CVSS 3.1HIGH 8.8
  • TI-2022-20284 Incorrect default permissions found in Sourcegraph CVSS 3.1CRITICAL 9.0
  • TI-2022-11715 Remote Code Execution in sourcegraph CVSS 3.1HIGH 7.2
  • TI-2022-07695 Side-channel attack in Sourcegraph Code Monitors CVSS 3.1MEDIUM 6.5
  • TI-2021-19629 Side-channel attack in Sourcegraph CVSS 3.1MEDIUM 6.5
  • TI-2020-09815 Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper… CVSS 3.1MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences