CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad



CVE-2022-24433

Git Rekt: The Simple-Git Command Injection Deep Dive

Alon Barad
Alon Barad
Software Engineer

Jan 2, 2026·6 min read·30 visits

Executive Summary (TL;DR)

Versions of `simple-git` prior to 3.3.0 fail to sanitize input in the `fetch()` function. Attackers can inject Git flags (specifically `--upload-pack`) to achieve Remote Code Execution (RCE). The fix involves a regex blocklist against this specific flag.

A critical argument injection vulnerability in the popular `simple-git` Node.js library allows attackers to execute arbitrary system commands via the `.fetch()` method. By abusing Git's `--upload-pack` flag, malicious inputs can trick the underlying git binary into executing shell commands.

Official Patches

GitHubPull Request containing the fix

Fix Analysis (1)

Technical Appendix

CVSS Score
8.1/ 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Probability
0.93%
Top 24% most exploited

Affected Systems

Node.js applications using simple-git < 3.3.0CI/CD pipelines using vulnerable simple-git versionsElectron apps utilizing simple-git for repo management

Affected Versions Detail

Product
Affected Versions
Fixed Version
simple-git
steveukx
< 3.3.03.3.0
AttributeDetail
CWE IDCWE-88 (Argument Injection)
CVSS v3.18.1 (High)
Attack VectorNetwork (Input to .fetch)
Affected Componentsimple-git .fetch() method
Key Flag--upload-pack
Exploit StatusPoC Available / Verified in CTFs

MITRE ATT&CK Mapping

T1202Indirect Command Execution
Execution
T1059Command and Scripting Interpreter
Execution
CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The software constructs a string for a command from trusted and untrusted data but does not properly neutralize argument delimiters, allowing the injection of new arguments.

Known Exploits & Detection

HackTheBoxExploitation in the FormulaX machine using --upload-pack
SnykOriginal disclosure and Proof of Concept

Vulnerability Timeline

Vulnerability Disclosed by Snyk
2022-03-11
CVE-2022-24433 Assigned
2022-03-11
Patch v3.3.0 Released
2022-03-11
Documented usage in HTB FormulaX
2024-08-31

References & Sources

  • [1]NVD Entry
  • [2]GitHub Advisory
  • [3]Snyk Advisory
Related Vulnerabilities
CVE-2022-25860CVE-2022-25912

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•17 minutes ago•CVE-2026-68921
4.7

CVE-2026-68921: Cross-Site Scripting via SVG Attribute Injection in DiceBear

CVE-2026-68921 is a Cross-Site Scripting (XSS) vulnerability affecting the `@dicebear/core` and `@dicebear/initials` packages. The flaw stems from a disconnect between compile-time TypeScript type definitions and runtime JavaScript execution. Unvalidated numeric-typed options can receive raw string payloads at runtime, allowing attackers to escape XML attribute boundaries and inject malicious vector markup, executing arbitrary script code within the user's web origin.

Amit Schendel
Amit Schendel
1 views•7 min read
•about 1 hour ago•CVE-2026-67446
5.3

CVE-2026-67446: Unbounded Image Dimension Decoding in Mailpit Thumbnail Generation

Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. This allows remote, unauthenticated attackers to trigger unconstrained memory allocation and cause a Denial of Service (DoS) via resource exhaustion.

Alon Barad
Alon Barad
1 views•7 min read
•about 2 hours ago•CVE-2026-72921
8.1

CVE-2026-72921: Incorrect Authorization in SeaweedFS Filer JWT Prefix Match

SeaweedFS is a distributed storage system. Prior to version 4.24, the Filer JWT validation mechanism used a raw prefix match, allowing scoped tokens to access sibling directories sharing similar name prefixes.

Amit Schendel
Amit Schendel
4 views•6 min read
•about 3 hours ago•CVE-2026-67445
5.3

CVE-2026-67445: Uncontrolled Memory Resource Consumption in Mailpit SMTP and POP3 Services

An uncontrolled resource consumption vulnerability in Mailpit versions prior to 1.30.4 allows remote, unauthenticated attackers to cause a denial of service (DoS) by sending unbounded command lines to the SMTP and POP3 servers. This memory exhaustion condition bypasses maximum message size limits.

Alon Barad
Alon Barad
2 views•6 min read
•about 5 hours ago•CVE-2026-73843
9.6

CVE-2026-73843: Critical Missing Authentication and Privilege Escalation in OpenChoreo Cluster Gateway

Prior to versions 1.0.2 and 1.1.2, OpenChoreo's cluster gateway combined public agent traffic and administrative control-plane APIs on a single TCP port (8443). Exposing this port allowed external unauthenticated actors to access sensitive proxy and execution interfaces.

Alon Barad
Alon Barad
9 views•7 min read
•about 6 hours ago•CVE-2026-73841
8.8

CVE-2026-73841: Broken Object Level Authorization (BOLA) in OpenChoreo Container Exec and Wirelogs Endpoints

An Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA) vulnerability in OpenChoreo allows authenticated users with project-level permissions to bypass tenant boundaries. By manipulating client-controlled query parameters, an attacker can execute arbitrary commands inside Kubernetes containers or view sensitive communication streams of resources belonging to other, highly privileged projects within the same namespace.

Alon Barad
Alon Barad
2 views•7 min read