CVE-2026-102827
HighCVSS 8.1Summary
simple-git before 4.0.0 has a flaw in the default blockUnsafeOperationsPlugin, which compares parsed option names against literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can bypass detectVulnerableFlags and cause Git to invoke an attacker-selected command.
Risk Assessment
Node.js applications that pass user-influenced push arguments may allow an attacker to execute arbitrary commands with the privileges of the Node.js process. This can lead to system compromise or data theft.
Recommendation
Upgrade simple-git to version 4.0.0 or later. Additionally, avoid passing untrusted arguments directly to git push operations.
Other vulnerabilities in simple-git
See all- CVE-2026-102826High
simple-git before 4.0.0 does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes with the privileges of the Node.js process.
- CVE-2026-102828Critical
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.
- CVE-2026-6951Critical
A vulnerability in the simple-git library before version 3.36.0 allows Remote Code Execution (RCE) due to an incomplete fix for CVE-2022-25912. The fix blocked the -c option but not the equivalent --config form, enabling an attacker to use the ext:: protocol for code execution.
- CVE-2026-28292Critical
The `simple-git` library versions 3.15.0 through 3.32.2 contain a vulnerability that bypasses fixes for CVE-2022-25860 and CVE-2022-25912, leading to remote code execution on the host. The issue is fixed in version 3.23.0.
- CVE-2026-28291High
The vulnerability in simple-git up to version 3.31.1 allows arbitrary command execution through Git option manipulation, bypassing safety checks for dangerous options like -u and --upload-pack. The issue stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regex-based blocklist. Due to the virtually infinite number of valid option variants accepted by Git, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior.
Original NVD description (English source)
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS