CVE-2022-41943
CRITICALsourcegraph < 4.1.0 - Authenticated Remote Code Execution via Experimental customGitFetch Feature
Title source: llmDescription
sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch` feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0.
References (2)
Core 2
Core References
Issue Tracking, Patch, Third Party Advisory
https://github.com/sourcegraph/sourcegraph/pull/42704
Third Party Advisory
https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-4qhq-4x4h-fxm8
Scores
CVSS v3
9.0
EPSS
0.0090
EPSS Percentile
55.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-276
Status
published
Products (1)
sourcegraph/sourcegraph
< 4.1.0
Published
Nov 22, 2022
Tracked Since
Feb 18, 2026