CVE-2026-102826

simple-git allows command execution through unblocked Git configuration includes

Published Sep 29, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0.

Analysis

Technical impact

simple‑git, a JavaScript wrapper for Git commands, contains an error in its default safety plug‑in that fails to block certain Git configuration includes passed through custom arguments to git.clone(). The resulting flaw lets an attacker supply a file path that Git will load as configuration, allowing that file to set options such as core.sshCommand. When Git invokes core.sshCommand during the clone operation it runs with the same privileges as the Node.js process. This flaw is a command‑execution vulnerability, classified as CWE‑78 (OS Command Injection) and CWE‑77 (Improperly Restricting Identifier or Path). An attacker can exploit the weakness to execute arbitrary code on the host system with the permissions of the running application.

Affected Systems

The vulnerability affects all releases of the steveukx:git-js package that are older than version 4.0.0. Developers using these versions in any Node.js application are at risk if the application passes attacker‑controlled arguments to git.clone(). Any earlier release of this package is similarly impacted.

Risk and Exploitability

The flaw carries a CVSS score of 8.1, indicating high severity. No EPSS score is available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild at the time of this assessment. The likely attack vector is inferred to be a remote or local source that can influence the customArgs sent to git.clone(); the exploit requires the attacker to supply a file that the application can read and that contains a Git configuration directive. Once the include is processed, Git will run an attacker‑supplied command with the application’s privileges, giving the attacker control of the target system.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

steveukx

git-js

affected

Version	Status	Constraints
`< 4.0.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:simple-git_project:simple-git:*:*:*:*:*:node.js:*:*

No data.

Vendor Product Versions

Steveukx

Git-js

Version	Status	Scheme	Platform
`[0,4.0.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the steveukx:git-js package to version 4.0.0 or later, which removes the vulnerability.
Review the application code for any customArgs passed to git.clone() and sanitize or eliminate arguments that reference include paths or includeIf directives.
If an upgrade is impossible, explicitly disable configuration includes by configuring the blockUnsafeOperationsPlugin to reject all include paths, or enforce strict validation of any user‑supplied arguments to prevent an attacker from injecting a configuration file.

Generated by OpenCVE AI on September 29, 2026 at 22:08 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-g4wm-2vf7-vfgr	simple-git allows command execution through unblocked Git configuration includes

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.464% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7
https://github.com/steveukx/git-js/pull/1193
https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0
https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr
https://nvd.nist.gov/vuln/detail/CVE-2026-102826
https://www.cve.org/CVERecord?id=CVE-2026-102826

History

Oct 8, 2026 8:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Simple-git Project Simple-git Project simple-git
CPEs		cpe:2.3:a:simple-git_project:simple-git::::::node.js::*
Vendors & Products		Simple-git Project Simple-git Project simple-git

Oct 2, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-102826 https://www.cve.org/CVERecord?id=CVE-2026-102826
Metrics	threat_severity `None`	threat_severity `Important`

Sep 29, 2026 9:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Steveukx Steveukx git-js
Vendors & Products		Steveukx Steveukx git-js

Sep 29, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 29, 2026 6:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0.
Title		simple-git allows command execution through unblocked Git configuration includes
Weaknesses		CWE-77 CWE-78
References		https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7 https://github.com/steveukx/git-js/pull/1193 https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0 https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Subscriptions

Simple-git Project Simple-git

Steveukx Git-js

Weaknesses

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')