CVE-2026-28292

CriticalCVSS 9.8

Published: 10/03/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.30%

67th percentile - higher than 67% of all known CVEs

Summary

The `simple-git` library versions 3.15.0 through 3.32.2 contain a vulnerability that bypasses fixes for CVE-2022-25860 and CVE-2022-25912, leading to remote code execution on the host. The issue is fixed in version 3.23.0.

Risk Assessment

An attacker can remotely execute arbitrary code on the server, potentially leading to full system compromise, data theft, or service disruption.

Recommendation

Immediately upgrade `simple-git` to version 3.23.0 or later, which includes the complete fix.

Original NVD description (English source)

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.