CVE-2026-6951 is a critical remote code execution vulnerability in the simple-git package prior to version 3.36.0. It stems from an incomplete fix for CVE-2022-25912, where the '-c' option was blocked but the '--config' option was not, enabling attackers to manipulate git configuration to allow execution of arbitrary code via the ext:: clone source. This vulnerability requires that untrusted input can reach the options argument passed to simple-git, making it exploitable remotely without user interaction and without privileges.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely on systems using vulnerable versions of simple-git if untrusted input is passed to the options argument. This can lead to full system compromise or unauthorized actions within the context of the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.36.0, upgrading to version 3.36.0 or later is likely the intended fix once available. Until then, avoid passing untrusted input to the options argument of simple-git or implement strict input validation to prevent exploitation.