CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2022-25766
High (8.8) in ungit project ungit. EPSS 35% chance of exploitation in the next 30 days. Fixed in ungit 1.5.20.
The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git options it was possible to get arbitrary command execution.
Severity
- EPSS
- 35% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWE
- CWE-88
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ungit_project:ungit
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hf8c-xr89-vfm5 | npm | ungit | <1.5.20 | 1.5.20 |