Is CVE-2019-14422 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2019-14422, but active exploitation has not been confirmed.

Can CVE-2019-14422 be exploited remotely?

Yes. CVE-2019-14422 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2019-14422?

CVE-2019-14422 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2019-14422

HIGHPOC

CVE-2019-14422

NVD-CWE-noinfoPublished: August 15, 2019· Updated: Jun 17, 2026

8.8

CVSS v3.1

Official Description

An issue was discovered in in TortoiseSVN 1.12.1. The Tsvncmd: URI handler allows a customised diff operation on Excel workbooks, which could be used to open remote workbooks without protection from macro security settings to execute arbitrary code. A tsvncmd:command:diff?path:[file1]?path2:[file2] URI will execute a customised diff on [file1] and [file2] based on the file extension. For xls files, it will execute the script diff-xls.js using wscript, which will open the two files for analysis without any macro security warning. An attacker can exploit this by putting a macro virus in a network drive, and force the victim to open the workbooks and execute the macro inside.

NVD Source

Technical Analysis

CVE-2019-14422 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.

A proof-of-concept (PoC) exploit exists for CVE-2019-14422. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.