-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the clone() method's handling of configuration arguments that enable unsafe protocols like 'ext'. The commit diff shows changes to configuration argument handling, and the advisory explicitly mentions the clone() method as the exploitation vector. The CWE-78 (OS Command Injection) aligns with the RCE mechanism through git's ext protocol, which executes arbitrary commands. The patch introduced 'allowUnsafeProtocolOverride' to explicitly control protocol usage, confirming the vulnerable pattern was present in clone().
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| simple-git | npm | < 3.15.0 | 3.15.0 |
JavaScriptJavaScriptOngoing coverage of React2Shell