CVE-2022-25648

CRITICAL Year: 2022
CVSS v3 Score
9.8
Critical
CVSS v2 Score
7.5
High
Weakness Type
CWE-88
View all →

Vulnerability Description

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Related Vulnerabilities

CVE-2016-10033

CRITICAL
CVSS:9.8(Critical)

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (bac...

CWE-882016

CVE-2017-1001003

CRITICAL
CVSS:9.8(Critical)

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.

CWE-882017

CVE-2018-10992

CRITICAL
CVSS:9.8(Critical)

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injec...

CWE-882018

CVE-2018-13385

CRITICAL
CVSS:9.8(Critical)

There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for ...

CWE-882018

CVE-2018-17456

CRITICAL
CVSS:9.8(Critical)

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git c...

CWE-882018

CVE-2019-10746

CRITICAL
CVSS:9.8(Critical)

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a con...

CWE-882019