CVE-2022-25648: Command Injection in ruby-git
Summary
CVE-2022-25648: Command injection in ruby-git. Affects git versions < 1.11.0. Fixed in 1.11.0. How to fix ↓
Also tracked for
The same CVE-2022-25648 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ruby-git package is a RubyGem that provides a Ruby interface to Git repositories. It allows developers to interact with Git repositories programmatically. The package is widely used in Ruby applications for version control and code management. However, versions prior to v1.11.0 are vulnerable to command injection.
Vulnerability Detail
The vulnerability in ruby-git (prior to v1.11.0) arises from a command injection flaw. Specifically, when calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand without proper sanitization. This allows an attacker to inject additional flags and execute arbitrary commands. The impact of this vulnerability is critical, as it enables an attacker to execute arbitrary commands on the system where the vulnerable code is running.
How To Fix
Latest published version: 5.6.0 as of 22 Oct 2026
gem install git -v 5.6.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.0
This is the first release that contains the fix.
gem install git -v 1.11.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the ruby-git package.
Conclusion
In conclusion, the ruby-git package prior to v1.11.0 is vulnerable to command injection, which allows an attacker to execute arbitrary commands. To mitigate this vulnerability, developers should update to version 1.11.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git →
FAQ
The vulnerability allows an attacker to execute arbitrary commands on the system where the vulnerable code is running. This can lead to unauthorized access, data breaches, and potential system compromise.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is important to update to the fixed version to mitigate the risk.
No, only versions prior to v1.11.0 are affected. Developers should update to the latest version to ensure they are protected against this vulnerability.
Yes, this vulnerability can be exploited remotely if the vulnerable code is exposed to the internet. It is crucial to update to the fixed version to prevent remote exploitation.
Yes, the CVSS score for this vulnerability is 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
