Read the docs
TI-2026-65517 Aliases CVE-2026-102828GHSA-x6jw-m9v5-85vh

simple-git unsafe-operation guard does not block trailer command configuration

Priority MEDIUM 42CWE-184Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.

Summary

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0037 31st percentileScored 2026-11-07
Fix Partial git-js (steveukx): 4.0.1simple-git (npm): 4.0.1Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
steveukxgit-js3.15.0 to before 4.0.14.0.1Patch availableCNA
—simple-git (npm)3.15.0 to before 4.0.14.0.1Patch availableGHSA-x6jw-m9v5-85vh
  • git-js Vendorsteveukx Affected 3.15.0 to before 4.0.1 Fixed in 4.0.1 Patch available CNA
  • simple-git (npm) Vendor— Affected 3.15.0 to before 4.0.1 Fixed in 4.0.1 Patch available GHSA-x6jw-m9v5-85vh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:simple-git_project:simple-git:*:*:*:*:*:node.js:*:*3.15.0 to before 4.0.1Vulnerablesteveukx
  • cpe:2.3:a:simple-git_project:simple-git:*:*:*:*:*:node.js:*:* Versions 3.15.0 to before 4.0.1 Vulnerable ·steveukx

Remediation

  • Fix · CNA git-js (steveukx) Fixed in 4.0.1
  • Fix · GHSA-x6jw-m9v5-85vh simple-git (npm) Fixed in 4.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of KeycloakAffectedNo fix yet
Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-102828
  2. 2026-10-06 Alias added: GHSA-x6jw-m9v5-85vh
  3. 2026-10-06 Fix available: npm/[email protected] · GHSA-x6jw-m9v5-85vh
  4. 2026-10-06 CVSS score added · GHSA-x6jw-m9v5-85vh
  5. 2026-10-06 Weakness changed · GHSA-x6jw-m9v5-85vh
  6. 2026-10-06 6 new references · GHSA-x6jw-m9v5-85vh
  7. 2026-10-06 Affected versions changed · Red Hat
  8. 2026-10-06 CVSS score added · Red Hat
  9. 2026-10-07 Affected versions changed · Red Hat
  10. 2026-10-08 Affected versions changed · Red Hat
  11. 2026-10-09 CVSS score added · NVD
  12. 2026-10-27 Affected versions changed · Red Hat

References

Patch 2

Advisory 2

Other 2

  • TI-2026-22598 simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE CVSS 3.1CRITICAL 9.8
  • TI-2022-09464 Remote code execution (RCE) in simple-git CVSS 3.1CRITICAL 9.8
  • TI-2026-06084 Code injection in simple-git CVSS 4.0CRITICAL 9.2
  • TI-2022-09425 Code injection in simple-git CVSS 3.1CRITICAL 9.8
  • TI-2026-65515 simple-git allows command execution through unblocked Git configuration includes CVSS 3.1HIGH 8.1
  • TI-2026-22597 simple-git has Command Execution via Option-Parsing Bypass CVSS 3.1HIGH 8.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences