CVE-2026-28291
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
The vulnerability in simple-git up to version 3.31.1 allows arbitrary command execution through Git option manipulation, bypassing safety checks for dangerous options like -u and --upload-pack. The issue stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regex-based blocklist. Due to the virtually infinite number of valid option variants accepted by Git, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior.
Risk Assessment
An attacker can remotely execute arbitrary system commands in the context of the application using the simple-git library, leading to full server compromise, data theft, or further attacks on the infrastructure.
Recommendation
Immediately update the simple-git library to version 3.32.0 or later. If an update is not possible, consider temporarily disabling Git command execution functionality or implementing additional application-level security controls.
Other vulnerabilities in simple-git
See all- CVE-2026-6951Critical
A vulnerability in the simple-git library before version 3.36.0 allows Remote Code Execution (RCE) due to an incomplete fix for CVE-2022-25912. The fix blocked the -c option but not the equivalent --config form, enabling an attacker to use the ext:: protocol for code execution.
- CVE-2026-28292Critical
The `simple-git` library versions 3.15.0 through 3.32.2 contain a vulnerability that bypasses fixes for CVE-2022-25860 and CVE-2022-25912, leading to remote code execution on the host. The issue is fixed in version 3.23.0.
Original NVD description (English source)
simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.