simple-git allows the execution of arbitrary commands by manipulating Git options that bypass the plugin designed to block unsafe operations. The flaw lies in an incomplete expurgation of option strings, letting attackers craft variants such as -vu or -nu that slip past a regular expression blocklist. This constitutes an OS command injection weakness (CWE-78). The impact is that any code executing through simple-git can run arbitrary shell commands, potentially compromising the host system where the Node.js application runs.

The vulnerability affects the simple-git library distributed by steveukx under the git-js project. Versions up to and including 3.31.1 are impacted, while version 3.32.0 and later contain the fix. Applications that rely on simple-git for remote Git interactions or local repository management are at risk if they use an affected version.

The CVSS score of 8.1 indicates high severity, reflecting that successful exploitation would provide full command execution. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no widespread known exploitation yet. Attackers would need the ability to influence or inject Git options into the simple-git call; this is typically possible when the application processes untrusted data that is passed to git commands.