EUVD-2026-89332

simple-git allows command execution through unblocked Git configuration includes...

GHSA-G4WM-2VF7-VFGR simple-git allows command execution through unblocked Git configuration includes

Summary An OS command injection vulnerability in git.clone allows any application that flows attacker-influenced data into customArgs to execute arbitrary code. simple-git 3.36.0 current latest on npm ships without any include.path entry in the blockUnsafeOperationsPlugin denylist. Passing -c...

2context (>=0.1.0, <=0.2.0), 2ndopinion-cli (>=0.1.0, <=0.12.0) +8427 more potentially affected by CVE-2026-102826 via simple-git (>=3.0.3, <=3.36.0)

simple-git NPM version =3.0.3, =0.1.0, =0.1.0, =0.16.0, =0.0.112-rc1, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0, =1.0.3, =1.1.0, =0.1.0, =0.3.0 and more Source cves: CVE-2026-102826 Source advisory: GHSA-G4WM-2VF7-VFGR...

NPM: simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

NPM: simple-git: unsafe-operations plugin bypass via git long-option abbreviation --receive-p/--exe - command execution residual of CVE-2026-28291 vulnerability discovered by ? in WordPress Npm simple-git versions = 3.36.0...

EUVD-2026-89333

simple-git: unsafe-operations plugin bypass via git long-option abbreviation --receive-p/--exe - command execution residual of CVE-2026-28291...

simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git's blockUnsafeOperationsPlugin blocks dangerous git options --upload-pack/--receive-pack/--exec/... unless the consumer opts in via unsafe:allowUnsafePack:true. Detection @simple-git/argv-parser detectVulnerableFlags matches the parsed flag NAME against literal-spelling patterns:...

2context (>=0.1.0, <=0.2.0), 2ndopinion-cli (>=0.1.0, <=0.12.0) +8427 more potentially affected by CVE-2026-102827 +1 more via simple-git (>=3.0.3, <=3.36.0)

simple-git NPM version =3.0.3, =0.1.0, =0.1.0, =0.16.0, =0.0.112-rc1, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0, =1.0.3, =1.1.0, =0.1.0, =0.3.0 and more Source cves: CVE-2026-102827, CVE-2026-28291 Source advisory: GHSA-858H-WHJF-MVG5...

GHSA-858H-WHJF-MVG5 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git's blockUnsafeOperationsPlugin blocks dangerous git options --upload-pack/--receive-pack/--exec/... unless the consumer opts in via unsafe:allowUnsafePack:true. Detection @simple-git/argv-parser detectVulnerableFlags matches the parsed flag NAME against literal-spelling patterns:...

CVE-2026-102828

A flaw was found in simple-git. The default security filter designed to block unsafe Git operations does not prevent trailer command configurations from being set. If an application passes untrusted user input into Git configuration options, an attacker can exploit this flaw to achieve arbitrary...

simple-git parseEnv Buffer Overflow

The vulnerability of the vulnerabilityCheck function in the parseEnv component of the simple-git library in the Node.js software platform is related to the use of an incomplete blacklist. Exploitation of this vulnerability could allow a malicious actor to bypass existing security mechanisms...

CVE-2026-102826

A flaw was found in simple-git. The library fails to properly sanitize Git configuration directives passed through custom clone arguments, which allows Git to load an attacker-controlled configuration file. By specifying executable settings within that configuration, an attacker can achieve...

Linux Distros Unpatched Vulnerability : CVE-2026-102826

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, th...

Arbitrary Command Injection

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Arbitrary Command Injection via the blockUnsafeOperationsPlugin, which fails to block dangerous git options such as --upload-pack, --receive-pac...

Arbitrary Command Injection

Overview org.webjars.npm:simple-git is an A light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Arbitrary Command Injection via the blockUnsafeOperationsPlugin, which fails to block dangerous git options such as...

Command Injection

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Command Injection via the rebase command handler and the trailer..cmd/trailer..command configuration keys, which allow an attacker to inject the...

2context (>=0.1.0, <=0.2.0), 2ndopinion-cli (>=0.1.0, <=0.12.0) +8320 more potentially affected by CVE-2026-102828 via simple-git (>=3.15.0, <=3.36.0)

simple-git NPM version =3.15.0, =0.1.0, =0.1.0, =0.16.0, =0.0.112-rc1, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0, =1.0.3, =1.1.0, =0.1.0, =0.3.0 and more Source cves: CVE-2026-102828 Source advisory: SNYK:JS-SIMPLEGIT-20335531...

Arbitrary Command Injection

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Arbitrary Command Injection via the detect-vulnerable-config-writes path in the argv-parser package, where unsanitised arguments passed to git...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the prepareEnv function in parse-env.ts, which fails to recognize the VISUAL environment variable as a tracked unsafe editor key. Because VISUAL is not included in the GitEnvKeys map, it is silently discarded befor...

ag-toolkit (0.7.0), one-way-git-sync (6.0.49) +1 more potentially affected by CVE-2026-102829 via @simple-git/argv-parser (2.0.0)

@simple-git/argv-parser NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @simple-git/argv-parser and may be impacted: - ag-toolkit 0.7.0 - one-way-git-sync 6.0.49 - simple-git =4.0.0, =4.0.1 Source cves: CVE-2026-102829 Source advisory...

CVE-2026-102828

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...