CVE-2022-41942

CVE-2022-41942 is a command injection vulnerability affecting Sourcegraph code intelligence platforms prior to version 4.1.0. The flaw, residing in the gitserver service's /list-gitolite endpoint, stems from insufficient input validation on the host parameter, allowing for arbitrary command execution within the container. Rated 7.8 HIGH on CVSS, successful exploitation requires local access to the gitserver and can lead to high impact on confidentiality, integrity, and availability. The attack complexity is low, and no user interaction is required. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules or significant community discussion surrounding this vulnerability. The EPSS score is very low, indicating a minimal likelihood of exploitation.