CVE-2022-24066: Simple-Git Project Simple-Git

Critical severity, CVSS 9.8. EPSS: 3.9% chance of exploitation in the next 30 days.

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.

Affected products

• Simple-Git Project Simple-Git: before 3.5.0 (fixed in 3.5.0)

Published 2022-04-01. Last modified 2026-06-17.