CVE-2026-63476

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloctargetSize. A malicious or...

CVE-2026-63476

The isomorphic-git library (a JavaScript implementation of Git for Node.js and browsers) is vulnerable to a Denial of Service (DoS) attack in versions prior to 1.38.6 . The root cause is located in src/utils/applyDelta.js, where the application reads a server-controlled targetSize from a packfile...

CVE-2026-63476 isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloctargetSize. A malicious or...

CVE-2026-63476 isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloctargetSize. A malicious or...

GHSA-G4WM-2VF7-VFGR simple-git allows command execution through unblocked Git configuration includes

Summary An OS command injection vulnerability in git.clone allows any application that flows attacker-influenced data into customArgs to execute arbitrary code. simple-git 3.36.0 current latest on npm ships without any include.path entry in the blockUnsafeOperationsPlugin denylist. Passing -c...

EUVD-2026-89332

simple-git allows command execution through unblocked Git configuration includes...

simple-git allows command execution through unblocked Git configuration includes

Summary An OS command injection vulnerability in git.clone allows any application that flows attacker-influenced data into customArgs to execute arbitrary code. simple-git 3.36.0 current latest on npm ships without any include.path entry in the blockUnsafeOperationsPlugin denylist. Passing -c...

SUSE CVE-2026-102826

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone. The...

Linux Distros Unpatched Vulnerability : CVE-2026-102826

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, th...

CVE-2026-102826

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone. The...

CVE-2026-102826 simple-git allows command execution through unblocked Git configuration includes

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone. The...

CVE-2026-102826

The simple-git Node.js library (prior to version 4.0.0 ) is vulnerable to command execution due to incomplete filtering of Git configuration includes via the customArgs parameter in git.clone(). The blockUnsafeOperationsPlugin fails to reject include.path and includeIf..path, allowing an attacker...

CVE-2026-102826 simple-git allows command execution through unblocked Git configuration includes

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone. The...

CVE-2026-102826 simple-git allows command execution through unblocked Git configuration includes

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone. The...

CVE-2026-102826

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone. The...

CVE-2026-102826: Improper Neutralization of Special Elements used in a Command

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone. The...

PT-2026-102810

Name of the Vulnerable Software and Affected Versions simple-git versions prior to 4.0.0 Description The default blockUnsafeOperationsPlugin fails to fully reject configuration includes provided via customArgs to the git.clone function. This allows Git to load an attacker-controlled configuration...

CVE-2026-92615

A flaw was found in flightctl. The configureRepoHTTPSClient function in the device-render worker builds a per-repository tls.Config which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates and installs it into go-git's process-global client.Protocols m...

CVE-2026-92615: Improper Resource Locking

A flaw was found in flightctl. The configureRepoHTTPSClient function in the device-render worker builds a per-repository tls.Config which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates and installs it into go-git's process-global client.Protocols m...

PT-2026-93828

A flaw was found in flightctl. The configureRepoHTTPSClient function in the device-render worker builds a per-repository tls.Config which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates and installs it into go-git's process-global client.Protocols m...