CVE-2026-102827

The simple-git Node.js library is vulnerable to a command execution flaw in versions prior to 4.0.0 . The root cause is that the default blockUnsafeOperationsPlugin compares parsed option names against literal dangerous spellings but fails to account for unambiguous long-option abbreviations acce...

CVE-2026-28291 simple-git has Command Execution via Option-Parsing Bypass

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for...