CVE-2022-25766: Command Injection in ungit
Summary
CVE-2022-25766: Command Injection in ungit. Affects ungit versions < 1.5.20. Fixed in 1.5.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ungit package is an open-source Git client that provides a web-based interface for managing Git repositories. It allows users to visualize and interact with their Git repositories through a browser. The package is widely used by developers and organizations for Git repository management. However, versions before 1.5.20 are vulnerable to a remote code execution (RCE) vulnerability.
Vulnerability Detail
The vulnerability in ungit (versions before 1.5.20) allows for remote code execution via command injection. The issue arises when calling the /api/fetch endpoint, where user-controlled values (remote and ref) are passed to the git fetch command. By injecting malicious git options, an attacker can execute arbitrary commands on the system. This can lead to unauthorized access, data breaches, and potential compromise of the entire system.
How To Fix
Latest published version: 1.5.30 as of 23 Oct 2026
npm install ungit@1.5.30Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.20
This is the first release that contains the fix.
npm install ungit@1.5.20Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality by blocking access to the /api/fetch endpoint. This can be done through network-level configurations or by modifying the application's routing rules. However, this workaround may impact the functionality of ungit and should only be considered as a temporary solution until the package is updated to a secure version.
Conclusion
The ungit package (versions before 1.5.20) is vulnerable to a command injection vulnerability that allows for remote code execution. To mitigate this risk, it is crucial to update the package to version 1.5.20 or later. Additionally, blocking access to the /api/fetch endpoint can serve as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ungit →
FAQ
Ungit is an open-source Git client that provides a web-based interface for managing Git repositories. It allows users to visualize and interact with their Git repositories through a browser.
The vulnerability allows for remote code execution, which can lead to unauthorized access, data breaches, and potential compromise of the entire system.
To fix this vulnerability, update the ungit package to version 1.5.20 or later.
As a temporary workaround, users can block access to the /api/fetch endpoint.
There is no known exploit available at the moment, but it is important to patch the vulnerability as soon as possible to prevent any potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for ungit.
