Threat database

CVE-2026-102829 is a critical OS command injection vulnerability in the steveukx git-js package, specifically related to the argv-parser dependency prior to version 2.0.1. The flaw allows an attacker to influence environment variables, causing Git to invoke an attacker-controlled editor during certain Git operations. This can lead to arbitrary command execution with the privileges of the Node.js process running git-js. The issue is fixed in argv-parser version 2.0.1.

A command injection vulnerability exists in the steveukx git-js library (simple-git) versions 3.15.0 through 4.0.0. The default blockUnsafeOperationsPlugin does not treat trailer.<token>.cmd as unsafe, allowing attacker-controlled input via SimpleGitOptions.config or inline -c arguments to execute arbitrary shell commands with the Node.js process's OS permissions. This issue is fixed in version 4.0.1.

CVE-2026-102827 is a command injection vulnerability in the steveukx git-js library prior to version 4.0.0. The issue arises because the default blockUnsafeOperationsPlugin does not properly handle unambiguous long-option abbreviations in Git commands, allowing attacker-controlled push arguments to bypass detection. This can lead to arbitrary command execution when git push is invoked with maliciously crafted arguments. The vulnerability is fixed in version 4.0.0.

CVE-2026-102826 is a command injection vulnerability in the simple-git library (git-js) prior to version 4.0.0. The vulnerability arises because the default blockUnsafeOperationsPlugin does not fully reject unsafe configuration includes supplied via customArgs to git.clone(), allowing attacker-controlled configuration files to be loaded. This can lead to execution of arbitrary commands with the privileges of the Node.js process running the application. The issue is fixed in version 4.0.0.

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.