CVE-2022-25648: Command Injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-19 · updated 2026-06-17
Weakness: CWE-88

Description

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Affected products

Debian Linux: 10.0
Fedoraproject Extra Packages For Enterprise Linux: 8.0
Fedoraproject Fedora: 34, 35, 36
Git: before 1.11.0 — fixed in 1.11.0

How to fix

Upgrade to a fixed version: Git 1.11.0. Check the vendor advisory for mitigations.

References

https://github.com/ruby-git/ruby-git/pull/569
https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0
https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTJUF6SFPL4ZVSJQHGQ36KFPFO5DQVYZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q2V3HOFU4ZVTQZHAVAVL3EX2KU53SP7R/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWNJA7WPE67LJ3DJMWZ2TADHCZKWMY55/
https://snyk.io/vuln/SNYK-RUBY-GIT-2421270
https://github.com/ruby-git/ruby-git/pull/569
https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0
https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTJUF6SFPL4ZVSJQHGQ36KFPFO5DQVYZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q2V3HOFU4ZVTQZHAVAVL3EX2KU53SP7R/

Get alerted when CVE-2022-25648 or the next vulnerability affects your stack