This vulnerability occurs when applications using simple‑git versions older than 4.0.0 supply Git push arguments that use abbreviated long options such as --receive-pack or --exec. The unsafe‑operations plugin attempts to block dangerous options by comparing parsed names with literal spellings, but Git’s handling of unambiguous abbreviations allows these options to be interpreted as valid. An attacker can therefore inject an arbitrary command through the git push operation, causing the underlying git process to execute a command chosen by the attacker. This results in remote command execution within the context of the application, leading to loss of confidentiality, integrity, or availability.

Affected systems are Node.js applications that include the steveukx git‑js package with a version earlier than 4.0.0. The vulnerability is present in all releases of simple‑git before the 4.0.0 release, regardless of other dependencies. Versions 4.0.0 and later contain the fix.

The CVSS score of 8.1 indicates high severity. EPSS data is not available, but the vulnerability remains in the public domain and could be exploited by malicious actors that can influence git push arguments to the application. The vulnerability is not listed in the CISA KEV catalog, yet the potential for arbitrary command execution makes it a high‑risk target. Attackers could achieve this by sending crafted push requests to a server that runs an untrusted git server or via a file‑based remote, triggering execution of arbitrary commands on the host machine.