CVE-2022-23642

CVE-2022-23642 is a remote code execution vulnerability affecting Sourcegraph versions prior to 3.37, stemming from improper restriction of git config commands in the gitserver service. This allows an authenticated attacker to manipulate the git core.sshCommand option, leading to arbitrary command execution. With a CVSS score of 8.8 (HIGH), the vulnerability has a low attack complexity and can result in complete compromise of confidentiality, integrity, and availability. Exploit code is publicly available, including a Metasploit module and an ExploitDB entry, although there is currently no evidence of active exploitation or significant community discussion.