CVE-2022-41942

HIGH

Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerabilit...

Affects 1 product across 1 vendor.

CVSS 3.17.8
EPSS2.8%
Percentile86th
PatchUnknown
CVSS Vector — Plain English Requires local access, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-20: Improper Input Validation

Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.

CWE-78: OS Command Injection

Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.

Related Attack Patterns (CAPEC)
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
via CWE-20
CAPEC-7 Blind SQL Injection
via CWE-20
CAPEC-8 Buffer Overflow in an API Call
via CWE-20
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-20
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-20
Show all 53
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-78
via CWE-78
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A command injection vulnerability exists in Sourcegraph versions prior to 4.1.0, affecting the gitserver service. This issue arises from insufficient validation of the host parameter in the /list-gitolite endpoint, allowing for the execution of arbitrary commands within the container.

BSID: BS-2022-GLOBAL-064430-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-41942?
A command injection vulnerability exists in Sourcegraph versions prior to 4.1.0, affecting the gitserver service. This issue arises from insufficient validation of the host parameter in the /list-gitolite endpoint, allowing for the execution of arbitrary commands within the container.
What is the CVSS score for CVE-2022-41942?
CVE-2022-41942 has CVSS 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS: 2.8%.
Is CVE-2022-41942 actively exploited?
No confirmed active exploitation of CVE-2022-41942 as of 2026-05-30.
How do I remediate CVE-2022-41942?
Priority: HIGH.
What systems are affected by CVE-2022-41942?
CVE-2022-41942 affects Sourcegraph Sourcegraph.
Vulnerability Details
CVE IDCVE-2022-41942
BSIDBS-2022-GLOBAL-064430-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published2022-11-22
Last Modified2024-11-21
ICS Relevance15%
Weakness (CWE)
Improper Input ValidationOS Command Injection
SourceNVD
Official Description

Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by sending a specially crafted request to the /list-gitolite endpoint with a maliciously constructed host parameter. This can lead to command execution within the gitserver container, potentially compromising the integrity and confidentiality of the system.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Sourcegraph Sourcegraph < 4.1.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1423 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashb0299ed23d4d1015d1db91dc3ead809fa7db15486bbe691240a6fdcd6a9e988a3ab71493cae47f30516967c975f8ff6c6899af78ebd842ae65363913bb4f120d
Related CVEs affecting Sourcegraph
CVE-2022-23642 8.8 Sourcegraph is a code search and navigation engine. Sourcegraph prior to vers... CVE-2023-46248 8.8 Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode ... CVE-2022-29171 7.2 Sourcegraph is a fast and featureful code search and navigation engine. Versi... CVE-2022-41943 7.2 sourcegraph is a code intelligence platform. As a site admin it was possible ... CVE-2021-43823 6.5 Sourcegraph is a code search and navigation engine. Sourcegraph prior to vers...
View all Sourcegraph CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →