CVE-2026-102828

simple-git before 4.0.0 has a flaw in the default blockUnsafeOperationsPlugin, which compares parsed option names against literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can bypass detectVulnerableFlags and cause Git to invoke an attacker-selected command.

simple-git before 4.0.0 does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes with the privileges of the Node.js process.

A vulnerability in the simple-git library before version 3.36.0 allows Remote Code Execution (RCE) due to an incomplete fix for CVE-2022-25912. The fix blocked the -c option but not the equivalent --config form, enabling an attacker to use the ext:: protocol for code execution.

The `simple-git` library versions 3.15.0 through 3.32.2 contain a vulnerability that bypasses fixes for CVE-2022-25860 and CVE-2022-25912, leading to remote code execution on the host. The issue is fixed in version 3.23.0.

The vulnerability in simple-git up to version 3.31.1 allows arbitrary command execution through Git option manipulation, bypassing safety checks for dangerous options like -u and --upload-pack. The issue stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regex-based blocklist. Due to the virtually infinite number of valid option variants accepted by Git, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior.