[ CVE-2026-102828 · Published 29 Sep 2026 ]
simple-git unsafe-operation guard does not block trailer command configuration
CVSS 9.8
EPSS <1%Fix available
[ Why it matters ]Priority signals
- Critical severity: CVSS 9.8
[ Description ]Official description
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.
[ Fixes ]Fixes and patches
- simple-git 4.0.1Fixed version · GitHub Advisories · npm package simple-git: upgrade to 4.0.1 or later (affected >= 3.15.0, < 4.0.1)
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ Packages ]Affected open-source packages
- simple-git npmAffected >= 3.15.0, < 4.0.1 · fixed in 4.0.1 · GHSA-x6jw-m9v5-85vh