Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

10 records

Vendor: steveukx Component: Simple-git Clear all filters
TI-2026-65516 CVE-2026-102827 · GHSA-858h-whjf-mvg5

Command injection in steveukx git-js

Priority MEDIUM 44

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00576 Published 2026-09-29 Partial fix · 4.0.0 CWE-77
TI-2026-06084 CVE-2026-6951 · GHSA-hffm-xvc3-vprc

Code injection in simple-git

Priority HIGH 81

Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c opt…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00877 Published 2026-04-25 Partial fix · 3.36.0 CWE-94
TI-2026-22598 CVE-2026-28292 · GHSA-r275-fr43-pm7q

simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE

Priority HIGH 82

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01441 Published 2026-03-10 Partial fix · 3.32.3 CWE-178
TI-2022-09425 CVE-2022-25860 · GHSA-9w5j-4mwv-2wj8

Code injection in simple-git

Priority HIGH 76

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02828 Published 2023-01-24 Fixed in 3.16.0 CWE-94
TI-2022-09464 CVE-2022-25912 · GHSA-9p95-fxvg-qgq2

Remote code execution (RCE) in simple-git

Priority HIGH 82

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03077 Published 2022-12-12 Fixed in 3.15.0 CWE-78
TI-2022-08024 CVE-2022-24066 · GHSA-28xr-mwxg-3qc8

Command injection in simple-git

Priority MEDIUM 49

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attac…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03896 Published 2022-04-01 Fixed in 3.5.0 CWE-88
TI-2022-08306 CVE-2022-24433 · GHSA-3f95-r44v-8mrg

Command injection in simple-git

Priority MEDIUM 48

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03707 Published 2022-03-11 Fixed in 3.3.0 CWE-88