Patchfirst
Patchfirst
Chainsteveukx · simple-gitnpm:simple-git

steveukx simple-git: incomplete fixes (2022–2026)

7 CVEs over 5 generations, 11 Mar 2022 to 25 Apr 2026.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2022-2443311 Mar 2022 First in the chain
  2. CVE-2022-240661 Apr 2022 incomplete fix for CVE-2022-24433
  3. CVE-2022-2591212 Dec 2022 incomplete fix for CVE-2022-24066
  4. CVE-2022-2586024 Jan 2023 incomplete fix for CVE-2022-25912
  5. CVE-2026-2829210 Mar 2026 bypassed the fix for CVE-2022-25912bypassed the fix for CVE-2022-25860
  6. CVE-2026-2829113 Apr 2026 incomplete fix for CVE-2022-25860
  7. CVE-2026-695125 Apr 2026 incomplete fix for CVE-2022-25912next fix after CVE-2026-28292
20222023202420252026 CVE-2022-24433 → CVE-2022-24066: incomplete fix (high confidence)CVE-2022-24066 → CVE-2022-25912: incomplete fix (high confidence)CVE-2022-25912 → CVE-2022-25860: incomplete fix (high confidence)CVE-2022-25912 → CVE-2026-28292: bypassed the fix (high confidence)CVE-2022-25912 → CVE-2026-6951: incomplete fix (high confidence)CVE-2022-25860 → CVE-2026-28291: incomplete fix (high confidence)CVE-2022-25860 → CVE-2026-28292: bypassed the fix (high confidence)CVE-2026-28292 → CVE-2026-6951: Next fix in the same package (low confidence) CVE-2022-24433 11 Mar 2022 CVE-2022-24066 1 Apr 2022 CVE-2022-25912 12 Dec 2022 CVE-2022-25860 24 Jan 2023 CVE-2026-28292 10 Mar 2026 CVE-2026-28291 13 Apr 2026 CVE-2026-6951 25 Apr 2026 20222023202420252026 CVE-2022-24433 → CVE-2022-24066: incomplete fix (high confidence)CVE-2022-24066 → CVE-2022-25912: incomplete fix (high confidence)CVE-2022-25912 → CVE-2022-25860: incomplete fix (high confidence)CVE-2022-25912 → CVE-2026-28292: bypassed the fix (high confidence)CVE-2022-25912 → CVE-2026-6951: incomplete fix (high confidence)CVE-2022-25860 → CVE-2026-28291: incomplete fix (high confidence)CVE-2022-25860 → CVE-2026-28292: bypassed the fix (high confidence)CVE-2026-28292 → CVE-2026-6951: Next fix in the same package (low confidence) CVE-2022-24433 11 Mar 2022 CVE-2022-24066 1 Apr 2022 CVE-2022-25912 12 Dec 2022 CVE-2022-25860 24 Jan 2023 CVE-2026-28292 10 Mar 2026 CVE-2026-28291 13 Apr 2026 CVE-2026-6951 25 Apr 2026
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2022-24433 11 Mar 2022 Command Injection · fixed in 3.3.0 First in chain 23.6
CVE-2022-24066 1 Apr 2022 Command Injection · fixed in 3.5.0 CVE-2022-24433 · incomplete fix · High 23.7
CVE-2022-25912 12 Dec 2022 Remote Code Execution (RCE) · fixed in 3.15.0 CVE-2022-24066 · incomplete fix · High 23.2
CVE-2022-25860 24 Jan 2023 Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone()… · fixed in 3.16.0 CVE-2022-25912 · incomplete fix · High 22.9
CVE-2026-28292 10 Mar 2026 simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE · fixed in 3.32.3 CVE-2022-25912 · bypassed the fix · High 26.1
CVE-2026-28291 13 Apr 2026 simple-git has Command Execution via Option-Parsing Bypass · fixed in 3.32.0 CVE-2022-25860 · incomplete fix · High 16.8
CVE-2026-6951 25 Apr 2026 Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete… · fixed in 3.36.0 CVE-2022-25912 · incomplete fix · High 23.7
↑ ↓ chooseEnter openEsc close