Executive brief
simple-git is a Node.js library used by developers to programmatically execute Git operations. An attacker can execute arbitrary code on a server or workstation using simple-git by crafting malicious Git repository URLs or arguments that bypass input validation. This could allow an attacker to take full control of the affected system, steal source code or credentials, or deploy malware.
Technical details
This vulnerability is a remote code execution (RCE) flaw affecting simple-git versions before 3.16.0, caused by incomplete input sanitization in the clone(), pull(), push(), and listRemote() methods. The root cause is an incomplete fix for CVE-2022-25912; attackers can inject malicious command-line arguments (such as --upload-pack or --receive-pack) that are passed unsafely to underlying Git commands. The attack is network-reachable and requires no authentication—an attacker only needs to control a Git repository URL or convince an application to use a crafted URL. This allows arbitrary command injection leading to remote code execution with the privileges of the Node.js process. The vulnerability is fixed in version 3.16.0, which requires explicit opt-in via the allowUnsafePack option to use such arguments.
Affected products
- simple-git simple-git before 3.16.0
Timeline
- 2023-01-26: disclosed
- 2022-12-22: patched: fix merged in PR #881