Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

simple-git could let attackers run code

CVE-2022-24433 · published today
Summary

The simple-git library used in GitHub Actions/simple-git, simple-git_project/simple-git, simple-git and @rootio/simple-git had a security weakness that could allow an attacker to execute code on your system. The issue has been fixed in newer releases. Update to the latest version of each affected package as soon as possible.

What to do
  • Update GitHub Actions simple-git to version 3.3.0.
  • Update simple-git to version 2.48.0-aikido.2.
  • Update rootio @rootio/simple-git to version 2.48.0-root.io.2.
  • Update simple-git_project simple-git to version 3.3.0 or later.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions simple-git < 3.3.0
Fix: upgrade to 3.3.0
– simple-git_project simple-git < 3.3.0
cpe:2.3:a:simple-git_project:simple-git:*:*:*:*:*:node.js:*:*
Root:npm – simple-git < 2.48.0-aikido.2
Fix: upgrade to 2.48.0-aikido.2
Root:npm rootio @rootio/simple-git < 2.48.0-root.io.2
Fix: upgrade to 2.48.0-root.io.2
Original advisory text
CVE-2022-24433 in simple-git - Patched by Root
Root has patched CVE-2022-24433 in the simple-git package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
4% chance of attack within 30 days
Type
CWE-74Injection
CWE-77Command Injection
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published9 Nov 2026
Updated9 Nov 2026
First seen6 Mar 2026
Sources
GHSA-3f95-r44v-8mrg · GHSA
CVE-2022-24433 · NVD
CVE-2022-24433 · OSV
ROOT-APP-NPM-CVE-2022-24433 · OSV
Track software like this
Free during beta