Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

simple-git could let attackers run code

CVE-2022-25912 · published today
Summary

The simple-git library used in several projects has a security issue that could let an attacker execute unwanted code. Updated versions of the library have been released to fix the problem. Update all simple-git packages to the latest versions as soon as possible.

What to do
  • Update GitHub Actions simple-git to version 3.15.0.
  • Update simple-git to version 3.7.1-aikido.2.
  • Update rootio @rootio/simple-git to version 3.7.1-root.io.2.
  • Update simple-git to version 3.7.1-aikido.3.
  • Update rootio @rootio/simple-git to version 3.7.1-root.io.3.
  • Update simple-git to version 3.10.0-aikido.3.
  • Update rootio @rootio/simple-git to version 3.10.0-root.io.3.
  • Update simple-git_project simple-git to version 3.15.0 or later.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions simple-git < 3.15.0
Fix: upgrade to 3.15.0
– simple-git_project simple-git < 3.15.0
cpe:2.3:a:simple-git_project:simple-git:*:*:*:*:*:node.js:*:*
Root:npm – simple-git < 3.7.1-aikido.2
< 3.7.1-aikido.3
< 3.10.0-aikido.3
Fix: upgrade to 3.7.1-aikido.2
Root:npm rootio @rootio/simple-git < 3.7.1-root.io.2
< 3.7.1-root.io.3
< 3.10.0-root.io.3
Fix: upgrade to 3.7.1-root.io.2
Original advisory text
CVE-2022-25912 in simple-git - Patched by Root
Root has patched CVE-2022-25912 in the simple-git package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published7 Nov 2026
Updated7 Nov 2026
First seen6 Mar 2026
Sources
GHSA-9p95-fxvg-qgq2 · GHSA
CVE-2022-25912 · NVD
CVE-2022-25912 · OSV
ROOT-APP-NPM-CVE-2022-25912 · OSV
Track software like this
Free during beta