simple‑git, a JavaScript wrapper for Git commands, contains an error in its default safety plug‑in that fails to block certain Git configuration includes passed through custom arguments to git.clone(). The resulting flaw lets an attacker supply a file path that Git will load as configuration, allowing that file to set options such as core.sshCommand. When Git invokes core.sshCommand during the clone operation it runs with the same privileges as the Node.js process. This flaw is a command‑execution vulnerability, classified as CWE‑78 (OS Command Injection) and CWE‑77 (Improperly Restricting Identifier or Path). An attacker can exploit the weakness to execute arbitrary code on the host system with the permissions of the running application.

The vulnerability affects all releases of the steveukx:git-js package that are older than version 4.0.0. Developers using these versions in any Node.js application are at risk if the application passes attacker‑controlled arguments to git.clone(). Any earlier release of this package is similarly impacted.

The flaw carries a CVSS score of 8.1, indicating high severity. No EPSS score is available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild at the time of this assessment. The likely attack vector is inferred to be a remote or local source that can influence the customArgs sent to git.clone(); the exploit requires the attacker to supply a file that the application can read and that contains a Git configuration directive. Once the include is processed, Git will run an attacker‑supplied command with the application’s privileges, giving the attacker control of the target system.