CVE-2022-41943

HIGH

sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch` feature was enabled. This experimental...

Affects 1 product across 1 vendor.

CVSS 3.17.2
EPSS1.8%
Percentile78th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, high privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-276: Incorrect Default Permissions

Software sets overly permissive default access rights during installation or resource creation.

Related Attack Patterns (CAPEC)
CAPEC-81 Web Server Logs Tampering
via CWE-276
CAPEC-127 Directory Indexing
via CWE-276
CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
via CWE-276

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A vulnerability in Sourcegraph allows site administrators to execute arbitrary commands on Gitserver when the experimental `customGitFetch` feature is enabled.

BSID: BS-2022-GLOBAL-064432-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-41943?
A vulnerability in Sourcegraph allows site administrators to execute arbitrary commands on Gitserver when the experimental `customGitFetch` feature is enabled.
What is the CVSS score for CVE-2022-41943?
CVE-2022-41943 has CVSS 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.8%.
Is CVE-2022-41943 actively exploited?
No confirmed active exploitation of CVE-2022-41943 as of 2026-05-30.
How do I remediate CVE-2022-41943?
Priority: HIGH.
What systems are affected by CVE-2022-41943?
CVE-2022-41943 affects Sourcegraph Sourcegraph.
Vulnerability Details
CVE IDCVE-2022-41943
BSIDBS-2022-GLOBAL-064432-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published2022-11-22
Last Modified2024-11-21
ICS Relevance15%
Weakness (CWE)
Incorrect Default Permissions
SourceNVD
Official Description

sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch` feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper validation of user input in the `customGitFetch` feature, which can be exploited by a malicious site administrator to run arbitrary commands on the Gitserver.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Sourcegraph Sourcegraph < 4.1.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1423 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashc43b899452cd7a1d03af583b111e3be17d337edd71985c6d9ec2a704660860694cd079c757282ef6fb7c28c9c84733ad86f8a5f241294e6861a3be3eaacfe4d8
Related CVEs affecting Sourcegraph
CVE-2022-23642 8.8 Sourcegraph is a code search and navigation engine. Sourcegraph prior to vers... CVE-2023-46248 8.8 Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode ... CVE-2022-41942 7.8 Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a com... CVE-2022-29171 7.2 Sourcegraph is a fast and featureful code search and navigation engine. Versi... CVE-2022-23643 6.5 Sourcegraph is a code search and navigation engine. Sourcegraph versions 3.35...
View all Sourcegraph CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →