Patch Forecast
Amber warning
Patch this week.

CVE-2026-102828 · GHSA-x6jw-m9v5-85vh

simple-git unsafe-operation guard does not block trailer command configuration

Risk score
75/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.4%
Published
29 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled va…
Affected
simple-git (npm) >= 3.15.0, < 4.0.1
Fix
Upgrade simple-git to 4.0.1 or later.
Exploitation
No known exploitation

Story map

Story map: simple-gitTHE FLAWSTHE FIXCVE-2026-102828Simple-git unsafe-operationguard does not block trailercommand configurationCVSS 9.8 · EPSS 0%CVE-2026-102827Unsafe-operations pluginbypass via git long-optionabbreviation…CVSS 9.8 · EPSS 0%CVE-2026-102826Simple-git allows commandexecution through unblockedGit configuration includesCVSS 8.1 · EPSS 0%Upgrade simple-git4.0.1 · 4.0.0or later on your release lineWho is exposedsimple-git (npm) <= 3.36.0RED · ACT TODAYsimple-gitsimple-git, an interface forrunning git commands in anynode.js application, enablesapplications to execute Gitoperations from JavaScript.Prior to 4.0.0, the defaultblockUnsafeOperationsPlugin…Where it standsPublic proof of conceptCONNECTS TOSame weaknessOS command injection (CWE-78)307 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

simple-git: Red, act today. simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviati…

The flaws

  • CVE-2026-102828: Simple-git unsafe-operation guard does not block trailer command configuration (CVSS 9.8 · EPSS 0%)
  • CVE-2026-102827: Unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) (CVSS 9.8 · EPSS 0%)
  • CVE-2026-102826: Simple-git allows command execution through unblocked Git configuration includes (CVSS 8.1 · EPSS 0%)

The fix

Upgrade simple-git: 4.0.1 · 4.0.0 or later on your release line

Who is exposed: simple-git (npm) <= 3.36.0

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
simple-gitnpm>= 3.15.0, < 4.0.14.0.1

References

Original description

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.

Last activity 29 Sep 2026. Patch Forecast updates every hour.