simple‑git’s safety guard fails to recognize trailer command configuration as unsafe, allowing an attacker to insert arbitrary shell commands through configuration options or inline -c arguments. The resulting command runs with the operating‑system identity of the Node.js process, giving the attacker full control over the host system. The weakness aligns with command injection failures (CWE‑184, CWE‑78) and can be used for remote code execution.

The vulnerability affects the steveukx:git-js package in all releases from 3.15.0 up to, but not including, 4.0.1. Affected applications that import simple‑git between these versions can expose an attacker‑controlled configuration to git’s interpret‑trailers routine. The issue was addressed in 4.0.1.

With a CVSS score of 9.2, the flaw is considered critical. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high severity rating indicates that a successful exploit would provide unrestricted execution. The likely attack vector occurs when an application passes untrusted values through SimpleGitOptions.config or inline -c arguments, enabling the attacker to inject shell commands that git will run as the Node.js process. The exploitation requires the application to enable configuration injection, which many untrusted or user‑controlled contexts do.