Skip to content

Product

debian/ruby-git vulnerabilities

3 published CVES affecting debian/ruby-git, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
1
High
2
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest debian/ruby-git CVEs

Newest publication first

  1. CVE-2022-46648 ruby-git has potential remote code execution vulnerability

    HighCVSS 8.0 PoC

    The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the git ls-files command using eval() to unescape quoted file names. If a file name was added to the git repository contained special characters, such as \n, then the git ls-files command would print...

  2. CVE-2022-25648 Command injection in ruby-git

    CriticalCVSS 9.8 PoC

    The package prior to v1.11.0 is vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way such that additional flags can be set. The additional fla...

  3. CVE-2022-47318 Code injection in ruby git

    HighCVSS 8.0 EPSS 1.4%

    ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.