Security Advisory

CVE-2022-25766

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2022-03-21 17:15:16

Last updated 2024-09-16 22:41:07

Assigner snyk

CVSS score 8.8

State PUBLISHED

Description

The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git options it was possible to get arbitrary command execution.

← Browse all CVEs View on cve.org ↗