CVE-2022-24066: Command Injection in simple-git
Summary
CVE-2022-24066: Command injection in simple-git. Affects simple-git versions < 3.5.0. Fixed in 3.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
simple-git is a lightweight interface for running git commands in any node.js application. It is maintained as the git-js repository on GitHub. The package is designed to provide a convenient way to interact with Git repositories in a Node.js environment. However, versions of simple-git prior to 3.5.0 are vulnerable to command injection due to an incomplete fix of CVE-2022-24433. The previous fix only addressed the git fetch attack vector, leaving the --upload-pack feature of git clone vulnerable. This vulnerability allows an attacker to execute arbitrary commands on the host system, potentially leading to unauthorized access, data loss, or other malicious activities.
Vulnerability Detail
The vulnerability in simple-git arises from the incomplete fix of CVE-2022-24433. The package supports the --upload-pack feature of git clone, which was not covered by the previous fix. An attacker can exploit this vulnerability by injecting malicious commands through the --upload-pack parameter during a git clone operation. This can lead to the execution of arbitrary commands on the host system, enabling unauthorized access, data manipulation, or other malicious activities. The impact of this vulnerability can be severe, depending on the privileges of the user running the affected application.
How To Fix
Latest published version: 4.0.2 as of 23 Oct 2026
npm install simple-git@4.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.0
This is the first release that contains the fix.
npm install simple-git@3.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of simple-git to mitigate the risk of command injection.
Conclusion
The command injection vulnerability in simple-git can be mitigated by upgrading to version 3.5.0 or later. It is crucial to promptly update the package to ensure the security of your application. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simple-git →
FAQ
simple-git is a lightweight interface for running git commands in Node.js applications. It provides a convenient way to interact with Git repositories.
Command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a host system. In the case of simple-git, this vulnerability can be exploited by injecting malicious commands through the --upload-pack parameter during a git clone operation.
CVE-2022-24066 is the identifier for the command injection vulnerability in simple-git. It was assigned to this specific vulnerability to track and reference it in security databases and advisories.
The impact of this vulnerability can be severe, depending on the privileges of the user running the affected application. It can lead to unauthorized access, data manipulation, or other malicious activities on the host system.
To fix this vulnerability, it is recommended to upgrade to simple-git version 3.5.0 or later. This version includes a fix that addresses the command injection vulnerability. Update the package by running the following command:
npm install simple-git@3.5.0
Related vulnerabilities
Recent vulnerabilities recorded for simple-git.
