{"id":"CVE-2026-102828","title":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript","summary":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<tok…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-78","CWE-184"],"vendor":"simple-git_project","product":"simple-git","affected":["simple-git >= 3.15.0, < 4.0.1"],"patched":["simple-git 4.0.1"],"published":"2026-09-29","updated":"2026-10-08","sourceUpdated":"2026-10-08T20:03:07.760","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102828","references":[{"url":"https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3","label":"security-advisories@github.com"},{"url":"https://github.com/steveukx/git-js/pull/1198","label":"security-advisories@github.com"},{"url":"https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.1","label":"security-advisories@github.com"},{"url":"https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102828"},{"url":"https://github.com/advisories/GHSA-x6jw-m9v5-85vh"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102828.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-102828"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543509"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102828"}],"tags":["nvd","cve.org","ghsa","npm","csaf","vex","red-hat"],"epss":0.0037,"epssPercentile":0.30737,"aliases":["GHSA-x6jw-m9v5-85vh"],"ecosystem":"npm","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-30T20:08:07.142494Z"},"scores":{"nvd":9.8,"cna":9.2,"vendor":8.1},"ingestedAt":"2026-09-29T19:44:04.149Z","slug":"CVE-2026-102828","body":"## Overview\n\nsimple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.\n\n## Affected\n\n- `simple-git >= 3.15.0, < 4.0.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `simple-git 4.0.1`\n\n## Package advisory (CVE-2026-102828)\n\nAffected packages:\n\n- `simple-git >= 3.15.0, < 4.0.1`\n\nPatched in:\n\n- `simple-git 4.0.1`\n\nSource: https://github.com/advisories/GHSA-x6jw-m9v5-85vh\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Build of Keycloak, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Build of Keycloak, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102828.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":218258,"id":"CVE-2026-102828","ts":1791490020608,"field":"cvss","old":"9.2","new":"9.8"}]}