simple-git
npm7 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting simple-gitpage 1 of 1
- CVE-2022-24066HIGHCVSS 8.1EG 8.1✓ Fixed in 3.5.02022-04-01
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar…
- CVE-2022-24433HIGHCVSS 8.1EG 8.1✓ Fixed in 3.3.02022-03-11
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By i…
- CVE-2022-25860HIGHCVSS 8.1EG 8.1✓ Fixed in 3.16.02023-01-26
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix…
- CVE-2022-25912HIGHCVSS 8.1EG 8.1✓ Fixed in 3.15.02022-12-06
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-240…
- CVE-2026-28291HIGHCVSS 8.1EG 8.1✓ Fixed in 3.32.02026-04-13
simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and…
- CVE-2026-28292CRITICALCVSS 9.8EG 9.8✓ Fixed in 3.32.32026-03-10
`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remot…
- CVE-2026-6951CRITICALCVSS 9.8EG 9.8✓ Fixed in 3.36.02026-04-25
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equ…
Check whether simple-git is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for simple-git CVEs against the assets you own.
Start Free Scan →