CVE-2026-6951

Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution RCE due to an incomplete fix for "CVE-2022-25912" https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221 that blocks the -c option but not the equivalent --config form. If untrusted input can reach the optio...