CVE-2022-24066 (High) detected in simple-git-2.48.0.tgz

[mend-bolt-for-github]

CVE-2022-24066 - High Severity Vulnerability

Vulnerable Library - simple-git-2.48.0.tgz

Simple GIT interface for node.js

Library home page: https://registry.npmjs.org/simple-git/-/simple-git-2.48.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/simple-git/package.json

Dependency Hierarchy:

• crowdin-cli-3.0.19.tgz (Root Library)
  • ❌ simple-git-2.48.0.tgz (Vulnerable Library)

Found in HEAD commit: 1652e069621eaf83756f08575ba0365a130349a8

Found in base branch: master

Vulnerability Details

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector.
A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.

Publish Date: 2022-04-01

URL: CVE-2022-24066

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24066

Release Date: 2022-04-01

Fix Resolution: simple-git - 3.5.0

---

Step up your Open Source Security Game with WhiteSource here

[github-actions]

Message that will be displayed on users' first issue

[github-actions]

👋 Thanks for reporting!

[worldpeacez0991]

Issue is regarding this file 'package.json' is not updated to simple-git 3.5.0.
https://github.com/Cado-Labs/CrowdinCLI/blob/master/package.json -- is reading past version "simple-git": "^2.39.0".

Cado-Labs/CrowdinCLI#17 -- reads that simple-git is updated by dependabot from version 2.39.0 to 3.5.0, but rejected due to CI/audit fail.

how do we fix this issue, re-pull request for the file 'package.json' or leave it?

kindly assist me, please