9.8
Critical
CVE-2026-28292 `simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0…
Description
`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| simple-git 3.15 | 3.15.0 → < 3.32.3 | 3.32.3 |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat Process Automation 7 | Versions not published |
References
- github.com github.com
- github.com github.com
- www.codeant.ai www.codeant.ai
Timeline
- Published
- Last modified