3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +609 more potentially affected by CVE-2022-25860 +1 more via simple-git (>=3.0.3, <=3.31.1)

simple-git NPM version =3.0.3, =1.0.1, =1.0.1, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =23.0.0, =35.0.0, =1.4.0, =0.26.4, =0.1.5-alpha.0, =1.0.2, =8.7.2, =8.11.4 and more Source cves: CVE-2022-25860, CVE-2026-28291 Source advisory: SNYK:JS-SIMPLEGIT-16032290...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +609 more potentially affected by CVE-2026-28291 via simple-git (>=3.0.3, <=3.31.1)

simple-git NPM version =3.0.3, =1.0.1, =1.0.1, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =23.0.0, =35.0.0, =1.4.0, =0.26.4, =0.1.5-alpha.0, =1.0.2, =8.7.2, =8.11.4 and more Source cves: CVE-2026-28291 Source advisory: OSV:GHSA-JCXM-M3JX-F287...

EUVD-2026-22026

simple-git Affected by Command Execution via Option-Parsing Bypass...

GHSA-JCXM-M3JX-F287 simple-git Affected by Command Execution via Option-Parsing Bypass

Summary simple-git enables running native Git commands from JavaScript. Some commands accept options that allow executing another command; because this is very dangerous, execution is denied unless the user explicitly allows it. This vulnerability allows a malicious actor who can control the...

Command Injection

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Command Injection through improper option parsing in the clone method. An attacker can execute arbitrary system commands by supplying specially...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +609 more potentially affected by CVE-2022-25860 +1 more via simple-git (>=3.0.3, <=3.31.1)

simple-git NPM version =3.0.3, =1.0.1, =1.0.1, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =23.0.0, =35.0.0, =1.4.0, =0.26.4, =0.1.5-alpha.0, =1.0.2, =8.7.2, =8.11.4 and more Source cves: CVE-2022-25860, CVE-2026-28291 Source advisory: GHSA-JCXM-M3JX-F287...

simple-git Affected by Command Execution via Option-Parsing Bypass

Summary simple-git enables running native Git commands from JavaScript. Some commands accept options that allow executing another command; because this is very dangerous, execution is denied unless the user explicitly allows it. This vulnerability allows a malicious actor who can control the...

Command Injection

Overview org.webjars.npm:simple-git is an A light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Command Injection through improper option parsing in the clone method. An attacker can execute arbitrary system commands by...

Linux Distros Unpatched Vulnerability : CVE-2026-28291

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option...

Simple Git operating system command injection vulnerabilities

Simple Git is a lightweight interface developed by Steve King from the UK. It is used to execute Git commands within any Node.js application. Versions of Simple Git 3.31.1 and earlier contained a vulnerability related to operating system command injection. This vulnerability stemmed from a bypass...

CVE-2026-28291: Improper Neutralization of Special Elements used in an OS Command

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for...

TencentOS Server 4: grafana (TSSA-2026:0177)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0177 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

SUSE CVE-2026-28292

simple-git, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes CVE-2022-25860 and CVE-2022-25912 and achieve full remote code execution on the host machine. Version 3.23.0 contains ...

Linux Distros Unpatched Vulnerability : CVE-2026-28292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass t...

CVE-2026-28292

simple-git, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes CVE-2022-25860 and CVE-2022-25912 and achieve full remote code execution on the host machine. Version 3.23.0 contains ...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +486 more potentially affected by CVE-2026-28292 via simple-git (>=3.15.0, <=3.32.2)

simple-git NPM version =3.15.0, =1.0.1, =1.0.1, =0.0.0-aj-beta.7, =23.0.0, =35.0.0, =1.4.0, =0.26.4, =0.1.5-alpha.0, =1.0.2, =8.7.2, =39.0.2, =39.0.3 and more Source cves: CVE-2026-28292 Source advisory: OSV:GHSA-R275-FR43-PM7Q...

GHSA-R275-FR43-PM7Q simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE

Summary The blockUnsafeOperationsPlugin in simple-git fails to block git protocol override arguments when the config key is passed in uppercase or mixed case. An attacker who controls arguments passed to git operations can enable the ext:: protocol by passing -c PROTOCOL.ALLOW=always, which...

Improper Handling of Case Sensitivity

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the preventProtocolOverride function, which fails to properly validate case-insensitive configuration...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +486 more potentially affected by CVE-2022-25912 +1 more via simple-git (>=3.15.0, <=3.32.2)

simple-git NPM version =3.15.0, =1.0.1, =1.0.1, =0.0.0-aj-beta.7, =23.0.0, =35.0.0, =1.4.0, =0.26.4, =0.1.5-alpha.0, =1.0.2, =8.7.2, =39.0.2, =39.0.3 and more Source cves: CVE-2022-25912, CVE-2026-28292 Source advisory: SNYK:JS-SIMPLEGIT-15457646...

Improper Handling of Case Sensitivity

Overview org.webjars.npm:simple-git is an A light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the preventProtocolOverride function, which fails to properly validate...