CVE-2022-1440

    Dashboard / Vulnerabilities / CVE-2022-1440

    CVE-2022-1440

    Published: 22 Apr 2022Last Modified: 12 Aug 2026

    Summary: Command Injection vulnerability in [email protected] in yarkeev/git-interface

    Details: Command Injection vulnerability in [email protected] in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.

    References: https://huntr.dev/bounties/cdc25408-d3c1-4a9d-bb45-33b12a715ca1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1440.json, https://nvd.nist.gov/vuln/detail/CVE-2022-1440, https://github.com/yarkeev/git-interface/commit/f828aa790016fee3aa667f7b44cf94bf0aa8c60d

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -f828aa790016fee3aa667f7b44cf94bf0aa8c60d

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-1440 | CVE-DB