Skip to content
fr Sign in
9.2 Critical

CVE-2026-102828 simple-git, an interface for running git commands in any node.js application, enables applications to execute Git…

Description

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.

Affected products and versions

Product Affected versions Fixed in
git-js 3.15 3.15.0 → < 4.0.1 4.0.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of git-js

The 5 CVEs of git-js →
CVE-2026-102829 simple-git, an interface for running git commands in any node.js application, enables applications to execute Git… 9.2 Critical CVE-2026-102827 simple-git, an interface for running git commands in any node.js application, enables applications to execute Git… 8.1 High CVE-2026-102826 simple-git, an interface for running git commands in any node.js application, enables applications to execute Git… 8.1 High CVE-2026-28291 simple-git enables running native Git commands from JavaScript 8.1 High
Track this CVE