253 matches found
3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +486 more potentially affected by CVE-2026-28292 via simple-git (>=3.15.0, <=3.32.2)
simple-git NPM version =3.15.0, =1.0.1, =1.0.1, =0.0.0-aj-beta.7, =23.0.0, =35.0.0, =1.4.0, =0.26.4, =0.1.5-alpha.0, =1.0.2, =8.7.2, =39.0.2, =39.0.3 and more Source cves: CVE-2026-28292 Source advisory: GHSA-R275-FR43-PM7Q...
EUVD-2026-10790
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE...
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
Summary The blockUnsafeOperationsPlugin in simple-git fails to block git protocol override arguments when the config key is passed in uppercase or mixed case. An attacker who controls arguments passed to git operations can enable the ext:: protocol by passing -c PROTOCOL.ALLOW=always, which...
CVE-2026-28292
The CVE-2026-28292 entry concerns the Node.js package simple-git. Affected versions are 3.15.0 through 3.32.2 and the issue bypasses prior fixes from CVE-2022-25860 and CVE-2022-25912, enabling full remote code execution on the host. A fix is noted in version 3.23.0. No exploitation details or in...
CVE-2026-28292 simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE
simple-git, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes CVE-2022-25860 and CVE-2022-25912 and achieve full remote code execution on the host machine. Version 3.23.0 contains ...
CVE-2026-28292
"simple-git", an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes CVE-2022-25860 and CVE-2022-25912 and achieve full remote code execution on the host machine. Version 3.23.0 contain...
3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +486 more potentially affected by CVE-2026-28292 via simple-git (>=3.15.0, <=3.32.2)
simple-git NPM version =3.15.0, =1.0.1, =1.0.1, =0.0.0-aj-beta.7, =23.0.0, =35.0.0, =1.4.0, =0.26.4, =0.1.5-alpha.0, =1.0.2, =8.7.2, =39.0.2, =39.0.3 and more Source cves: CVE-2026-28292 Source advisory: MEND:CVE-2026-28292...
CVE-2026-28292 simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE
simple-git, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes CVE-2022-25860 and CVE-2022-25912 and achieve full remote code execution on the host machine. Version 3.23.0 contains ...
CVE-2026-28292 simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE
simple-git, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes CVE-2022-25860 and CVE-2022-25912 and achieve full remote code execution on the host machine. Version 3.23.0 contains ...
CVE-2026-28292
simple-git, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes CVE-2022-25860 and CVE-2022-25912 and achieve full remote code execution on the host machine. Version 3.23.0 contains ...
EUVD-2026-10791
simple-git, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes CVE-2022-25860 and CVE-2022-25912 and achieve full remote code execution on the host machine. Version 3.23.0 contains ...
Simple Git security vulnerabilities
Simple Git is a lightweight interface developed by Steve King from the UK. It is used to execute Git commands within any Node.js application. Versions 3.15.0 to 3.32.2 of Simple Git contain security vulnerabilities. These vulnerabilities allow attackers to bypass previous CVE fixes, potentially...
CVE-2026-28292: Improper Neutralization of Special Elements used in an OS Command
simple-git, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes CVE-2022-25860 and CVE-2022-25912 and achieve full remote code execution on the host machine. Version 3.23.0 contains ...
PT-2026-24396
Name of the Vulnerable Software and Affected Versions simple-git versions 3.15.0 through 3.32.2 Description A case-sensitivity bypass in the blockUnsafeOperationsPlugin allows for remote code execution on the host machine. The preventProtocolOverride function uses a case-sensitive regular...
org.webjars.npm:g-status (2.0.2), org.webjars.npm:graphql-toolkit__git-loader (0.7.5) potentially affected by CVE-2022-25912 +1 more via org.webjars.npm:simple-git (>=1.129.0, <=1.132.0)
org.webjars.npm:simple-git MAVEN version =1.129.0, =1.132.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:simple-git and may be impacted: - org.webjars.npm:g-status 2.0.2 - org.webjars.npm:graphql-toolkitgit-loader 0.7.5 Source cves:...
3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +643 more potentially affected by CVE-2022-25912 +1 more via simple-git (>=3.0.3, <=3.35.2)
simple-git NPM version =3.0.3, =1.0.1, =1.0.1, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =23.0.0, =35.0.0, =1.4.0, =0.26.4, =0.1.5-alpha.0, =1.0.2, =0.0.0-aj-beta.221, =0.0.0-aj-beta.227 and more Source cves: CVE-2022-25912, CVE-2026-6951 Source advisory: SNYK:JS-SIMPLEGIT-15456078...
Remote Code Execution (RCE)
Overview org.webjars.npm:simple-git is an A light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Remote Code Execution RCE due to an incomplete fix for CVE-2022-25912 that blocks the -c option but not the equivalent --conf...
Remote Code Execution (RCE)
Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Remote Code Execution RCE due to an incomplete fix for CVE-2022-25912 that blocks the -c option but not the equivalent --config form. If untrust...