simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript

Overview

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.

Affected

• simple-git >= 3.15.0, < 4.0.1

Remediation

Upgrade past the affected range:

• simple-git 4.0.1

Package advisory (CVE-2026-102828)

Affected packages:

• simple-git >= 3.15.0, < 4.0.1

Patched in:

• simple-git 4.0.1

Source: https://github.com/advisories/GHSA-x6jw-m9v5-85vh

Vendor advisories

• Red Hat VEX · Important · affected: Red Hat Build of Keycloak, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Build of Keycloak, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-16 · vex