CVE-2022-23642

HIGH ⚠ Exploit

Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fa...

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS74.3%
Percentile99th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-94: Code Injection

Attacker injects arbitrary code that is executed by the application process.

CWE-862: Missing Authorization

Software does not check whether an authenticated actor has permission for the requested operation.

Related Attack Patterns (CAPEC)
CAPEC-35 Leverage Executable Code in Non-Executable Files
via CWE-94
CAPEC-665 Exploitation of Thunderbolt Protection Flaws
via CWE-862
CAPEC-77 Manipulating User-Controlled Variables
via CWE-94
CAPEC-242 Code Injection
via CWE-94

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Sourcegraph prior to version 3.37 is vulnerable to remote code execution due to improper restriction of the git config command in the gitserver service, allowing attackers to set the git core.sshCommand option to execute arbitrary commands.

BSID: BS-2022-GLOBAL-160538-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-23642?
Sourcegraph prior to version 3.37 is vulnerable to remote code execution due to improper restriction of the git config command in the gitserver service, allowing attackers to set the git core.sshCommand option to execute arbitrary commands.
What is the CVSS score for CVE-2022-23642?
CVE-2022-23642 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS: 74.3%.
Is CVE-2022-23642 actively exploited?
Public exploit available for CVE-2022-23642. Exploitation risk elevated.
How do I remediate CVE-2022-23642?
Priority: IMMEDIATE.
What systems are affected by CVE-2022-23642?
CVE-2022-23642 affects Sourcegraph Sourcegraph.
Vulnerability Details
CVE IDCVE-2022-23642
BSIDBS-2022-GLOBAL-160538-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published2022-02-18
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Code InjectionMissing Authorization
SourceNVD
Official Description

Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option, which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround, ensure that requests to gitserver are properly protected.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by setting the git core.sshCommand option to a malicious command through the gitserver service, which will be executed when git attempts to connect to a remote repository.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Sourcegraph Sourcegraph < 3.37
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1700 Days
CISA known-exploitedNot in KEV catalog
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
Related CVEs affecting Sourcegraph
CVE-2023-46248 8.8 Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode ... CVE-2022-41942 7.8 Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a com... CVE-2022-29171 7.2 Sourcegraph is a fast and featureful code search and navigation engine. Versi... CVE-2022-41943 7.2 sourcegraph is a code intelligence platform. As a site admin it was possible ... CVE-2021-43823 6.5 Sourcegraph is a code search and navigation engine. Sourcegraph prior to vers...
View all Sourcegraph CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →