Patch Forecast
Red warning
Act within 24 hours.

CVE-2026-102827 · GHSA-858h-whjf-mvg5

simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

Risk score
80/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.4%
Published
29 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviati…
Affected
simple-git (npm) <= 3.36.0
Fix
Upgrade simple-git to 4.0.0 or later.
Exploitation
Public proof of concept

Story map

Story map: simple-gitTHE FLAWSTHE FIXCVE-2026-102827Unsafe-operations pluginbypass via git long-optionabbreviation…CVSS 9.8 · EPSS 0%CVE-2026-102828Simple-git unsafe-operationguard does not block trailercommand configurationCVSS 9.8 · EPSS 0%CVE-2026-102826Simple-git allows commandexecution through unblockedGit configuration includesCVSS 8.1 · EPSS 0%Upgrade simple-git4.0.0 · 4.0.1or later on your release lineWho is exposedsimple-git (npm) <= 3.36.0RED · ACT TODAYsimple-gitsimple-git, an interface forrunning git commands in anynode.js application, enablesapplications to execute Gitoperations from JavaScript.Prior to 4.0.0, the defaultblockUnsafeOperationsPlugin…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCommand injection (CWE-77)96 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

simple-git: Red, act today. simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviati…

The flaws

  • CVE-2026-102827: Unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) (CVSS 9.8 · EPSS 0%)
  • CVE-2026-102828: Simple-git unsafe-operation guard does not block trailer command configuration (CVSS 9.8 · EPSS 0%)
  • CVE-2026-102826: Simple-git allows command execution through unblocked Git configuration includes (CVSS 8.1 · EPSS 0%)

The fix

Upgrade simple-git: 4.0.0 · 4.0.1 or later on your release line

Who is exposed: simple-git (npm) <= 3.36.0

Where it stands

  • Public proof of concept

Connects to

Why it is Red

  • CVSS 9.8 critical
  • Public exploit or proof of concept referenced
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
simple-gitnpm<= 3.36.04.0.0

References

Original description

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0.

Last activity 29 Sep 2026. Patch Forecast updates every hour.