CVE-2026-103431

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted proce...

Arbitrary Command Injection

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Arbitrary Command Injection via the detect-vulnerable-config-writes path in the argv-parser package, where unsanitised arguments passed to git...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the prepareEnv function in parse-env.ts, which fails to recognize the VISUAL environment variable as a tracked unsafe editor key. Because VISUAL is not included in the GitEnvKeys map, it is silently discarded befor...

ag-toolkit (0.7.0), one-way-git-sync (6.0.49) +1 more potentially affected by CVE-2026-102829 via @simple-git/argv-parser (2.0.0)

@simple-git/argv-parser NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @simple-git/argv-parser and may be impacted: - ag-toolkit 0.7.0 - one-way-git-sync 6.0.49 - simple-git =4.0.0, =4.0.1 Source cves: CVE-2026-102829 Source advisory...

CVE-2026-102829

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...

CVE-2026-102829 simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...

CVE-2026-102829 simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...

CVE-2026-102829 simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...

CVE-2026-102829

The simple-git library, which allows Node.js applications to execute Git operations, is vulnerable due to a flaw in the argv-parser package prior to version 2.0.1 . The parseEnv function omits VISUAL from GitEnvKeys, causing prepareEnv to drop the value before vulnerabilityCheck can identify it a...

2context (>=0.1.0, <=0.2.0), 2ndopinion-cli (>=0.1.0, <=0.12.0) +8449 more potentially affected by CVE-2026-102826 via @simple-git/argv-parser (1.1.1)

@simple-git/argv-parser NPM version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @simple-git/argv-parser and may be impacted: - 2context =0.1.0, =0.1.0, =0.16.0, =0.0.112-rc1, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0,...

CVE-2026-102829: Improper Neutralization of Special Elements used in an OS Command

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...

PT-2026-102814

Name of the Vulnerable Software and Affected Versions argv-parser versions prior to 2.0.1 Description The parseEnv function omits VISUAL from GitEnvKeys, causing prepareEnv to drop the value before vulnerabilityCheck can classify it as allowUnsafeEditor. In applications that forward...

PT-2026-83130

An issue in the with argv function /unistd/mod.rs of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via a crafted input...

PYSEC-2026-3964

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

CVE-2026-81715

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

PYSEC-2026-3964

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

CVE-2026-81715

openssl_encrypt (pip package openssl-encrypt ) versions ≤ 1.4.8 leak a keyserver bearer token in cleartext to stderr when the --debug flag is active. The root cause is that sanitize_argv_for_debug fails to redact the token passed as the positional argument to the keyserver set-token command. Beca...

EUVD-2026-67065

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

CVE-2026-81715 openssl_encrypt before 1.4.9 Credential Exposure via Debug Output

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

CVE-2026-81715

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...