CVE-2026-28292 is an OS command injection vulnerability in the simple-git library for Node.js, affecting versions 3.15.0 through 3.32.2. It allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and execute arbitrary commands remotely on the host machine. Version 3.23.0 includes an updated fix addressing this issue. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and related CWEs. The CVSS v3.1 base score is 9.8, reflecting its critical impact with network attack vector, no privileges required, no user interaction, and high confidentiality, integrity, and availability impact. The Red Hat advisory linked provides vendor confirmation but does not explicitly state patch availability beyond the fixed version indication.

Successful exploitation results in full remote code execution on the host running the vulnerable simple-git versions. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability bypasses previous fixes, indicating a significant security regression and increased risk.

Upgrade simple-git to a version later than 3.32.2, preferably at least 3.33.0 or later, as version 3.23.0 contains an updated fix and later versions should include the patch. Since the vendor advisory does not explicitly state patch availability beyond the fixed version, users should verify the latest patched version from the official simple-git repository or vendor advisories. No other mitigation or workaround is provided. Patch status is confirmed by the presence of a fixed version (3.23.0) in the description.