The vulnerability exists because simple-git versions before 4.0.0 do not completely reject configuration includes supplied via customArgs to git.clone(). Specifically, the default blockUnsafeOperationsPlugin misses include.path and includeIf.<condition>.path, enabling an attacker to load a malicious Git configuration file. This configuration can set executable Git options like core.sshCommand, which Git executes during cloning with Node.js process privileges. Exploitation requires the application to accept attacker-controlled custom arguments and an attacker-controlled file readable by the process. The vulnerability is addressed in version 4.0.0.

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the Node.js process running the simple-git interface. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts.

Upgrade to simple-git version 4.0.0 or later, where this vulnerability is fixed. Prior versions are vulnerable. No other mitigations are indicated in the advisory.