CVE-2026-102829

The simple-git library, which allows Node.js applications to execute Git operations, is vulnerable due to a flaw in the argv-parser package prior to version 2.0.1 . The parseEnv function omits VISUAL from GitEnvKeys, causing prepareEnv to drop the value before vulnerabilityCheck can identify it a...

CVE-2026-102828 simple-git unsafe-operation guard does not block trailer command configuration

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...

CVE-2026-102828 simple-git unsafe-operation guard does not block trailer command configuration

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...

CVE-2026-102828 simple-git unsafe-operation guard does not block trailer command configuration

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...

CVE-2026-102828

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...

1508-cli (>=1.0.4, <=1.0.6), 2context (>=0.1.0, <=0.2.0) +12594 more potentially affected by CVE-2026-102828 via simple-git (>=1.63.0, <=3.36.0)

simple-git NPM version =1.63.0, =1.0.4, =0.1.0, =1.0.0, =0.16.0, =0.0.80, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0, =3.1.4 and more Source cves: CVE-2026-102828 Source advisory: MEND:CVE-2026-102828...

2context (>=0.1.0, <=0.2.0), 5etools-utils (>=0.16.0, <=0.17.24) +8145 more potentially affected by CVE-2026-102828 via @simple-git/argv-parser (1.1.1)

@simple-git/argv-parser NPM version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @simple-git/argv-parser and may be impacted: - 2context =0.1.0, =0.16.0, =0.0.112-rc1, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0, =1.0.3,...

CVE-2026-102828

The simple-git library, a Node.js interface for Git commands, is vulnerable to arbitrary command execution in versions 3.15.0 through 4.0.1 . The root cause is that the default blockUnsafeOperationsPlugin fails to classify trailer..cmd as an unsafe configuration. An attacker providing controlled ...

CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102827

The simple-git Node.js interface for Git operations is vulnerable to command injection in versions prior to 4.0.0 . The root cause is that the blockUnsafeOperationsPlugin only compares option names against literal dangerous spellings, failing to account for Git's support for unambiguous long-opti...

CVE-2026-102827

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

1508-cli (>=1.0.4, <=1.0.6), 2context (>=0.1.0, <=0.2.0) +12651 more potentially affected by CVE-2026-102827 via simple-git (>=0.1.2, <=3.36.0)

simple-git NPM version =0.1.2, =1.0.4, =0.1.0, =1.0.0, =0.16.0, =0.0.80, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0, =3.1.4 and more Source cves: CVE-2026-102827 Source advisory: MEND:CVE-2026-102827...

CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102826 simple-git allows command execution through unblocked Git configuration includes

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone. The...

1508-cli (>=1.0.4, <=1.0.6), 2context (>=0.1.0, <=0.2.0) +12651 more potentially affected by CVE-2026-102826 via simple-git (>=0.1.2, <=3.36.0)

simple-git NPM version =0.1.2, =1.0.4, =0.1.0, =1.0.0, =0.16.0, =0.0.80, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0, =3.1.4 and more Source cves: CVE-2026-102826 Source advisory: MEND:CVE-2026-102826...

CVE-2026-102826 simple-git allows command execution through unblocked Git configuration includes

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone. The...

2context (>=0.1.0, <=0.2.0), 5etools-utils (>=0.16.0, <=0.17.24) +8145 more potentially affected by CVE-2026-102826 via @simple-git/argv-parser (1.1.1)

@simple-git/argv-parser NPM version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @simple-git/argv-parser and may be impacted: - 2context =0.1.0, =0.16.0, =0.0.112-rc1, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0, =1.0.3,...

CVE-2026-102826

The simple-git Node.js library (prior to version 4.0.0 ) is vulnerable to command execution due to incomplete filtering of Git configuration includes via the customArgs parameter in git.clone(). The blockUnsafeOperationsPlugin fails to reject include.path and includeIf..path, allowing an attacker...

CVE-2026-102826

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone. The...