9.8
Critical
CVE-2026-6951 Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete…
Description
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| simple-git 3.36 | earliest → < 3.36.0 | 3.36.0 |
| org.webjars.npm:simple-git | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat Process Automation 7 | Versions not published |
References
- security.snyk.io security.snyk.io
- security.snyk.io security.snyk.io
- gist.github.com gist.github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of simple-git
The 5 CVEs of simple-git →
CVE-2022-25860
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(),…
8.1
High
CVE-2022-25912
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport…
8.1
High
CVE-2022-24066
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of…
8.1
High
CVE-2022-24433
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection
8.1
High