CVE-2022-23642: Sourcegraph gitserver git config injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with a high CVSS score and very high EPSS probability, though exploitation requires access to the internal gitserver service and no KEV listing exists.

What it is

Sourcegraph before 3.37 fails to restrict calls to `git config` in its gitserver service, which acts as a git exec proxy. An attacker can set the `core.sshCommand` option so git runs an arbitrary command instead of ssh when connecting to a remote system, yielding remote code execution. The flaw matters because gitserver is an internal service that may be reachable from other parts of the deployment.

Impact

An attacker who can reach gitserver gains arbitrary command execution in the context of that service, with high impact to confidentiality, integrity and availability. This can lead to compromise of source code, credentials and the underlying host.

Attack surface

Reached over the network by sending HTTP requests to the internal gitserver service; the CVSS vector requires low privileges (PR:L) and no user interaction. Exploitability depends on deployment: the attacker must be able to make HTTP requests to internal services like gitserver.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.7431, 99.5th percentile) and public exploit write-ups are referenced on Packet Storm. No ransomware group use is documented.

What to do

• Upgrade Sourcegraph to version 3.37 or later, which patches the issue.
• If immediate upgrade is not possible, ensure requests to gitserver are properly protected so only trusted internal callers can reach it.
• Restrict network access to gitserver using firewall rules or service mesh policy, allowing only required components.
• Audit and rotate any credentials or SSH keys accessible to the gitserver service.
• Monitor gitserver for unexpected git configuration changes, especially core.sshCommand.

Detection

• Search gitserver logs and git config files for unexpected `core.sshCommand` values or other injected git config options.
• Alert on HTTP requests to gitserver endpoints that set git configuration from unusual source IPs or accounts.
• Monitor for outbound connections or process execution spawned by gitserver that do not match normal git operations.
• Review Sourcegraph audit logs for configuration changes around the time of suspected activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.