CVE-2026-28291

🗓️ 13 Apr 2026 17:15:14Reported by GitHub_MType

Simple-git versions up to 3.31.1 allow command execution via Git option bypass; fixed in 3.32.0.

Reporter	Title	Published	Views	Family All 21
ATTACKERKB	CVE-2026-28291	13 Apr 202617:15	–	attackerkb
Chainguard	CVE-2026-28291 vulnerabilities	6 Jul 202614:17	–	cgr
Circl	CVE-2026-28291	12 Apr 202615:13	–	circl
CNNVD	Simple Git 操作系统命令注入漏洞	13 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-28291 simple-git has Command Execution via Option-Parsing Bypass	13 Apr 202617:15	–	cvelist
EUVD	EUVD-2026-22026	13 Apr 202616:35	–	euvd
Github Security Blog	simple-git Affected by Command Execution via Option-Parsing Bypass	13 Apr 202616:35	–	github
NVD	CVE-2026-28291	13 Apr 202618:16	–	nvd
OSV	CGA-RPH4-7C9F-V9J4	6 Jul 202611:05	–	osv
OSV	CVE-2026-28291 simple-git has Command Execution via Option-Parsing Bypass	13 Apr 202617:15	–	osv

NVD

Vulners

Node

simple-git_project simple-gitRange<3.32.0node.js

[
  {
    "vendor": "steveukx",
    "product": "git-js",
    "versions": [
      {
        "version": "< 3.32.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
cve	www.cve.org/CVERecord
github	www.github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287
github	www.github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d
github	www.github.com/steveukx/git-js/releases/tag/simple-git%403.32.0
github	www.github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts
access	www.access.redhat.com/security/cve/CVE-2026-28291
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28291.json
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

30 Jun 2026 03:18Current

7.4High risk

Vulners AI Score7.4

CVSS 3.18.1

EPSS0.00652

SSVC

CWE-78