TI-2026-65518 Aliases CVE-2026-102829 GHSA-v5rq-49vh-5v5c

simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

HIGH 75CWE-184Published 2026-09-29 · Updated 2026-09-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: Present
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it as allowUnsafeEditor. A consuming application that forwards attacker-influenced environment values can therefore allow Git to invoke an attacker-selected editor during operations such as commit amendment or interactive rebase when no higher-priority editor setting overrides VISUAL and Git's terminal prerequisites are met. The executable runs with the privileges of the Node.js process. This issue is fixed in argv-parser 2.0.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00353 29th percentileScored 2026-11-07

Fix Fixed git-js (steveukx): 2.0.1@simple-git/argv-parser (npm): 2.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
steveukx	git-js	before 2.0.1	2.0.1	Patch available	CNA
—	@simple-git/argv-parser (npm)	before 2.0.1	2.0.1	Patch available	GHSA-v5rq-49vh-5v5c

git-js Vendorsteveukx Affected before 2.0.1 Fixed in 2.0.1 Patch available CNA
@simple-git/argv-parser (npm) Vendor— Affected before 2.0.1 Fixed in 2.0.1 Patch available GHSA-v5rq-49vh-5v5c

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:simple-git_project:simple-git::::::::	—	—	steveukx

cpe:2.3:a:simple-git_project:simple-git:*:*:*:*:*:*:*:* Versions — — ·steveukx

Remediation

Fix · CNA git-js (steveukx) Fixed in 2.0.1
Fix · GHSA-v5rq-49vh-5v5c @simple-git/argv-parser (npm) Fixed in 2.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 6 products

Red Hat Build of Keycloak
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat JBoss Enterprise Application Platform 8
Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

2026-10-02 Threatist record created from CVE-2026-102829
2026-10-06 Alias added: GHSA-v5rq-49vh-5v5c
2026-10-06 Fix available: npm/@simple-git/[email protected] · GHSA-v5rq-49vh-5v5c
2026-10-06 CVSS score added · GHSA-v5rq-49vh-5v5c
2026-10-06 Weakness changed · GHSA-v5rq-49vh-5v5c
2026-10-06 6 new references · GHSA-v5rq-49vh-5v5c
2026-10-21 Affected versions changed · Red Hat
2026-10-21 CVSS score added · Red Hat
2026-10-26 Affected versions changed · Red Hat

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-102829

Other 5

TI-2026-22598 simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE CVSS 3.1CRITICAL 9.8
TI-2022-09464 Remote code execution (RCE) in simple-git CVSS 3.1CRITICAL 9.8
TI-2026-06084 Code injection in simple-git CVSS 4.0CRITICAL 9.2
TI-2022-09425 Code injection in simple-git CVSS 3.1CRITICAL 9.8
TI-2026-65515 simple-git allows command execution through unblocked Git configuration includes CVSS 3.1HIGH 8.1
TI-2026-22597 simple-git has Command Execution via Option-Parsing Bypass CVSS 3.1HIGH 8.1

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences