simple-git, a Node.js library used to run git commands, contains a flaw that allows an attacker to bypass the blockUnsafeOperationsPlugin by exploiting a case‑insensitive protocol.allow configuration key. This bypass removes critical safety checks and enables the execution of arbitrary git operations, giving an attacker full remote code execution on the host system. The vulnerability also compromises previous patches for CVE-2022-25860 and CVE-2022-25912.

The issue affects steveukx’s simple‑git library for Node.js, specifically versions 3.15.0 through 3.32.2. Applications built with these versions and configured with a protocol.allow key that is not strictly lowercase are at risk. Version 3.23.0 contains a fix that eliminates the vulnerability, but any deployment still running an earlier version remains vulnerable.

With a CVSS score of 9.8 this flaw represents a high‑severity threat. Although the EPSS score is below 1%—indicating a low probability of exploitation in the wild—the potential impact is catastrophic. Attackers who can provide a malicious configuration or trigger a git operation via the library can execute arbitrary commands on the host. The attack vector is inferred to involve supplying a repository URL or configuration value that the application processes, thereby exploiting the case‑insensitive protocol.allow check. The vulnerability is not listed in the CISA KEV catalog, but its severity warrants urgent action.