CVE-2026-102826 · GHSA-g4wm-2vf7-vfgr
simple-git allows command execution through unblocked Git configuration includes
- Risk score
- 72/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path cl…
- Affected
- simple-git (npm) <= 3.36.0
- Fix
- Upgrade simple-git to 4.0.0 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
simple-git: Red, act today. simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviati…
The flaws
- CVE-2026-102826: Simple-git allows command execution through unblocked Git configuration includes (CVSS 8.1 · EPSS 0%)
- CVE-2026-102827: Unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) (CVSS 9.8 · EPSS 0%)
- CVE-2026-102828: Simple-git unsafe-operation guard does not block trailer command configuration (CVSS 9.8 · EPSS 0%)
The fix
Upgrade simple-git: 4.0.0 · 4.0.1 or later on your release line
Who is exposed: simple-git (npm) <= 3.36.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Command injection (CWE-77). 96 other warnings in 30 days
Why it is Amber
- CVSS 8.1 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| simple-git | npm | <= 3.36.0 | 4.0.0 |
References
- https://github.com/advisories/GHSA-g4wm-2vf7-vfgr
- https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr
- https://nvd.nist.gov/vuln/detail/CVE-2026-102826
- https://github.com/steveukx/git-js/pull/1193
- https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7
- https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0
- https://github.com/advisories/GHSA-g4wm-2vf7-vfgr
Original description
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0.
Last activity 29 Sep 2026. Patch Forecast updates every hour.