CVE-2022-25766: Ungit Project Ungit

High severity, CVSS 8.8. EPSS: 34.5% chance of exploitation in the next 30 days.

The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git options it was possible to get arbitrary command execution.

Affected products

• Ungit Project Ungit: before 1.5.20 (fixed in 1.5.20)

Published 2022-03-21. Last modified 2026-06-17.