CVE-2026-102826
HighCVSS 8.1Summary
simple-git before 4.0.0 does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes with the privileges of the Node.js process.
Risk Assessment
If an application passes untrusted arguments to git.clone(), an attacker may achieve arbitrary command execution with the privileges of the Node.js process. This requires an attacker-controlled file that the process can read.
Recommendation
Upgrade simple-git to version 4.0.0 or later. Do not pass untrusted customArgs to git.clone() and restrict file read access for the process.
Other vulnerabilities in simple-git
See all- CVE-2026-102827High
simple-git before 4.0.0 has a flaw in the default blockUnsafeOperationsPlugin, which compares parsed option names against literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can bypass detectVulnerableFlags and cause Git to invoke an attacker-selected command.
- CVE-2026-102828Critical
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.
- CVE-2026-6951Critical
A vulnerability in the simple-git library before version 3.36.0 allows Remote Code Execution (RCE) due to an incomplete fix for CVE-2022-25912. The fix blocked the -c option but not the equivalent --config form, enabling an attacker to use the ext:: protocol for code execution.
- CVE-2026-28292Critical
The `simple-git` library versions 3.15.0 through 3.32.2 contain a vulnerability that bypasses fixes for CVE-2022-25860 and CVE-2022-25912, leading to remote code execution on the host. The issue is fixed in version 3.23.0.
- CVE-2026-28291High
The vulnerability in simple-git up to version 3.31.1 allows arbitrary command execution through Git option manipulation, bypassing safety checks for dangerous options like -u and --upload-pack. The issue stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regex-based blocklist. Due to the virtually infinite number of valid option variants accepted by Git, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior.
Original NVD description (English source)
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS