This vulnerability is a residual flaw from a prior command injection issue where the -c option for passing Git configuration was blocked but the equivalent --config option was not. Due to an incomplete patch for CVE-2022-25912, any untrusted input that reaches the options parameter of simple-git can be used to inject shell commands. An attacker can craft a --config entry that sets protocol.ext.allow=always and provides an ext:: clone source, causing underlying shell code to execute with the privileges of the running Node.js process. The weakness is a code injection flaw as classified by CWE-94 and CWE-88.

The affected product is the npm package simple-git. Every installation that uses a version earlier than 3.36.0 is potentially vulnerable, regardless of the surrounding application, because the insecure handling occurs inside the library itself. Scripts or services that expose simple-git to user supplied options are at highest risk.

The CVSS score of 9.2 designates this flaw as critical, while the EPSS score of less than 1% suggests a presently low but non-zero exploitation likelihood. The absence of the vulnerability from CISA’s KEV catalog does not diminish the risk, as exploitation would rely on crafting tailored --config options that enable protocol.ext.allow and reference an ext:: source. An attacker with access to the options argument can achieve full remote code execution on the target system.