Threats affecting pkg:npm/simple-git

A command injection vulnerability exists in the steveukx git-js library (simple-git) versions 3.15.0 through 4.0.0. The default blockUnsafeOperationsPlugin does not treat trailer.<token>.cmd as unsafe, allowing attacker-controlled input via SimpleGitOptions.config or inline -c arguments to execute arbitrary shell commands with the Node.js process's OS permissions. This issue is fixed in version 4.0.1.

CVE-2026-102827 is a command injection vulnerability in the steveukx git-js library prior to version 4.0.0. The issue arises because the default blockUnsafeOperationsPlugin does not properly handle unambiguous long-option abbreviations in Git commands, allowing attacker-controlled push arguments to bypass detection. This can lead to arbitrary command execution when git push is invoked with maliciously crafted arguments. The vulnerability is fixed in version 4.0.0.

CVE-2026-102826 is a command injection vulnerability in the simple-git library (git-js) prior to version 4.0.0. The vulnerability arises because the default blockUnsafeOperationsPlugin does not fully reject unsafe configuration includes supplied via customArgs to git.clone(), allowing attacker-controlled configuration files to be loaded. This can lead to execution of arbitrary commands with the privileges of the Node.js process running the application. The issue is fixed in version 4.0.0.

Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.