Skip to content

[🐸 Frogbot] Update version of simple-git to 3.32.3#1244

Open
github-actions[bot] wants to merge 1 commit intov3_erfrom
frogbot-simple-git-a99748a7ee30ab36baea834e5557ab42
Open

[🐸 Frogbot] Update version of simple-git to 3.32.3#1244
github-actions[bot] wants to merge 1 commit intov3_erfrom
frogbot-simple-git-a99748a7ee30ab36baea834e5557ab42

Conversation

@github-actions
Copy link
Contributor

🚨 This automated pull request was created by Frogbot and fixes the below:

📦 Vulnerable Dependencies

Severity ID Contextual Analysis Direct Dependencies Impacted Dependency Fixed Versions
critical
Critical
CVE-2026-28292 Not Covered simple-git:3.19.1 simple-git 3.19.1 [3.32.3]

🔖 Details

Vulnerability Details

Contextual Analysis: Not Covered
Direct Dependencies: simple-git:3.19.1
Impacted Dependency: simple-git:3.19.1
Fixed Versions: [3.32.3]
CVSS V3: 9.8

simple-git, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.


Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant