Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-24066: simple-git may let attackers run unwanted code

CVE-2022-24066 · published today

Summary

The simple-git library used in several projects can be tricked into executing code that an attacker controls. This could allow unauthorized actions on your systems. Update to the latest patched version of simple-git as soon as possible to protect against this risk.

What to do

Update GitHub Actions simple-git to version 3.5.0.
Update simple-git to version 2.48.0-aikido.2.
Update rootio @rootio/simple-git to version 2.48.0-root.io.2.
Update simple-git_project simple-git to version 3.5.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	GitHub Actions	simple-git	< 3.5.0 Fix: upgrade to 3.5.0
–	simple-git_project	simple-git	< 3.5.0 `cpe:2.3:a:simple-git_project:simple-git::::::node.js::*`
Root:npm	–	simple-git	< 2.48.0-aikido.2 Fix: upgrade to 2.48.0-aikido.2
Root:npm	rootio	@rootio/simple-git	< 2.48.0-root.io.2 Fix: upgrade to 2.48.0-root.io.2

Original advisory text

CVE-2022-24066 in simple-git - Patched by Root

Root has patched CVE-2022-24066 in the simple-git package for Root:npm. Multiple fixed versions available.

References

https://github.com/steveukx/git-js/releases/tag/simple-git%403.5.0
https://github.com/advisories/GHSA-28xr-mwxg-3qc8
https://gist.github.com/lirantal/a930d902294b833514e821102316426b URL
https://nvd.nist.gov/vuln/detail/CVE-2022-24066 Vendor Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2434820 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24066... Vendor Advisory
https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306 Vendor Advisory
https://github.com/steveukx/git-js/commit/2040de601c894363050fef9f28af367b169a56... Patch

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

4% chance of attack within 30 days

Type

CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Timeline

Published9 Nov 2026

Updated9 Nov 2026

First seen6 Mar 2026

Sources

GHSA-28xr-mwxg-3qc8 · GHSA

CVE-2022-24066 · NVD

CVE-2022-24066 · OSV

ROOT-APP-NPM-CVE-2022-24066 · OSV

Track software like this

Free during beta