CVE-2022-24433: Command Injection in simple-git
Summary
CVE-2022-24433: Command injection in simple-git. Affects simple-git versions < 3.3.0. Fixed in 3.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
simple-git is an npm package that provides a simple API for executing Git commands programmatically. It allows developers to interact with Git repositories, perform operations like cloning, fetching, and pushing, and retrieve information about the repository. However, versions before 3.3.0 of simple-git are vulnerable to command injection, which can lead to arbitrary command execution. This vulnerability arises when calling the .fetch(remote, branch, handlerFn) function, where both the remote and branch parameters are passed to the git fetch subcommand. By injecting malicious git options, an attacker can execute arbitrary commands on the system.
Vulnerability Detail
The vulnerability in simple-git allows an attacker to inject malicious git options into the .fetch() function, leading to arbitrary command execution. This can have severe consequences, as an attacker can execute commands with the privileges of the user running the vulnerable application. They can potentially access sensitive data, modify the repository, or even compromise the entire system. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Latest published version: 4.0.2 as of 23 Oct 2026
npm install simple-git@4.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.0
This is the first release that contains the fix.
npm install simple-git@3.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can sanitize the remote and branch parameters passed to the .fetch() function. They should validate and sanitize the input to ensure that only valid and expected values are used. This can help mitigate the risk of command injection until the package is updated.
Conclusion
The command injection vulnerability in simple-git can lead to arbitrary command execution, posing a significant risk to applications utilizing this package. It is crucial to update to version 3.3.0 or later to mitigate this vulnerability. Developers should also consider implementing input validation and sanitization as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for simple-git →
FAQ
simple-git is an npm package that provides a simple API for executing Git commands programmatically. It allows developers to interact with Git repositories and perform various operations.
Command injection is a vulnerability that allows an attacker to execute arbitrary commands on a system. In the case of simple-git, the vulnerability arises when malicious git options are injected into the .fetch() function.
The consequences of this vulnerability can be severe. An attacker can execute arbitrary commands with the privileges of the user running the vulnerable application. This can lead to unauthorized access, data leakage, repository manipulation, or even full system compromise.
To fix this vulnerability, update the simple-git package to version 3.3.0 or later. Run the command 'npm install simple-git@latest' to update the package.
As a temporary workaround, developers can sanitize the remote and branch parameters passed to the .fetch() function. Validate and sanitize the input to ensure only valid and expected values are used.
Related vulnerabilities
Recent vulnerabilities recorded for simple-git.
