GHSA-hffm-xvc3-vprc
simple-git is vulnerable to Remote Code Execution
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | simple-git | < 3.36.0 | 3.36.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.
References
External links from the advisory. They lead to third-party sites.