CVE-2026-102827

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102826

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone. The...

2context (>=0.1.0, <=0.2.0), 2ndopinion-cli (>=0.1.0, <=0.12.0) +8006 more potentially affected by CVE-2026-102829 via @simple-git/argv-parser (>=1.1.1, <=2.0.0)

@simple-git/argv-parser NPM version =1.1.1, =0.1.0, =0.1.0, =0.16.0, =0.0.112-rc1, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0, =1.0.3, =1.1.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2026-102829 Source advisory: MEND:CVE-2026-102829...

CVE-2026-102829

The simple-git library, which allows Node.js applications to execute Git operations, is vulnerable due to a flaw in the argv-parser package prior to version 2.0.1 . The parseEnv function omits VISUAL from GitEnvKeys, causing prepareEnv to drop the value before vulnerabilityCheck can identify it a...

CVE-2026-102829

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...

CVE-2026-102829 simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...

CVE-2026-102829 simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...

2context (>=0.1.0, <=0.2.0), 2ndopinion-cli (>=0.1.0, <=0.12.0) +8006 more potentially affected by CVE-2026-102828 via @simple-git/argv-parser (1.1.1)

@simple-git/argv-parser NPM version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @simple-git/argv-parser and may be impacted: - 2context =0.1.0, =0.1.0, =0.16.0, =0.0.112-rc1, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0,...

CVE-2026-102828

The simple-git library, a Node.js interface for Git commands, is vulnerable to arbitrary command execution in versions 3.15.0 through 4.0.1 . The root cause is that the default blockUnsafeOperationsPlugin fails to classify trailer..cmd as an unsafe configuration. An attacker providing controlled ...

CVE-2026-102828

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...

CVE-2026-102828 simple-git unsafe-operation guard does not block trailer command configuration

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...

CVE-2026-102828 simple-git unsafe-operation guard does not block trailer command configuration

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...

1508-cli (>=1.0.4, <=1.0.6), 2context (>=0.1.0, <=0.2.0) +12450 more potentially affected by CVE-2026-102828 via simple-git (>=1.63.0, <=3.36.0)

simple-git NPM version =1.63.0, =1.0.4, =0.1.0, =0.1.0, =1.0.0, =0.16.0, =0.0.80, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =1.33.0 and more Source cves: CVE-2026-102828 Source advisory: MEND:CVE-2026-102828...

CVE-2026-102828 simple-git unsafe-operation guard does not block trailer command configuration

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...

CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102827

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102827

The simple-git Node.js interface for Git operations is vulnerable to command injection in versions prior to 4.0.0 . The root cause is that the blockUnsafeOperationsPlugin only compares option names against literal dangerous spellings, failing to account for Git's support for unambiguous long-opti...

CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

1508-cli (>=1.0.4, <=1.0.6), 2context (>=0.1.0, <=0.2.0) +12507 more potentially affected by CVE-2026-102827 via simple-git (>=0.1.2, <=3.36.0)

simple-git NPM version =0.1.2, =1.0.4, =0.1.0, =0.1.0, =1.0.0, =0.16.0, =0.0.80, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =1.33.0 and more Source cves: CVE-2026-102827 Source advisory: MEND:CVE-2026-102827...