CVE-2022-41943

CRITICAL

sourcegraph < 4.1.0 - Authenticated Remote Code Execution via Experimental customGitFetch Feature

Title source: llm
STIX 2.1

Description

sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch` feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0.

References (2)

Core 2

Scores

CVSS v3 9.0
EPSS 0.0090
EPSS Percentile 55.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-276
Status published
Products (1)
sourcegraph/sourcegraph < 4.1.0
Published Nov 22, 2022
Tracked Since Feb 18, 2026