CVE-2022-25648: Command Injection
Vulnerability summary
CVE-2022-25648 is a critical (CVSS 9.8) vulnerability in debian debian_linux. EPSS estimates a 4.91% chance of exploitation in the next 30 days, higher than 92.1% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3Timeline
- 19-04-2022PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:PDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · RubygemsEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.91%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.91% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (snyk.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- ruby-git< 1.13.1-1
- debian_linuxEOL10.0
Fedoraproject2 products
- extra_packages_for_enterprise_linux8.0
- fedoraEOL34 | 35 | 36
Git1 product
- git< 1.11.0
Mageia1 product
- ruby-git< 1.6.0-1.1.mga8
RubyGems1 product
- git< 1.11.0
Ubuntu1 product
- ruby-gitAll versions (No fix recorded)
6 vendors · 8 products
References
20 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
Show all 20 references
- github.com/ruby-git/ruby-gitPACKAGE