CVE-2022-39205

CVE-2022-39205 is a critical vulnerability affecting OneDev, an open-source Git server, in versions prior to 7.3.0. It allows unauthenticated attackers to achieve arbitrary code execution by manipulating environment variables during git command execution via the /git-prereceive-callback endpoint, which incorrectly relies on the X-Forwarded-For header for access control. This vulnerability carries a CVSS score of 9.8 (Critical) due to its network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While there are no known public exploits or active exploitation detected, the lack of workarounds and difficulty in detection make immediate patching essential.