GHSA-858H-WHJF-MVG5 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git's blockUnsafeOperationsPlugin blocks dangerous git options --upload-pack/--receive-pack/--exec/... unless the consumer opts in via unsafe:allowUnsafePack:true. Detection @simple-git/argv-parser detectVulnerableFlags matches the parsed flag NAME against literal-spelling patterns:...