Skip to content
OpenAdvisories

Package · npm

simple-git

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • Critical 9.2
    CVE-2026-102828

    simple-git unsafe-operation guard does not block trailer command configuration

    simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe conf…

    steveukx git-js simple-git npm
  • High 8.1
    CVE-2026-102827 Public exploit

    simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

    simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option sp…

    steveukx git-js simple-git npm
  • High 8.1
    CVE-2026-102826 Public exploit

    simple-git allows command execution through unblocked Git configuration includes

    simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied th…

    steveukx git-js simple-git npm
  • Critical 9.8
    CVE-2026-6951 Public exploit

    simple-git is vulnerable to Remote Code Execution

    Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config for…

    simple-git npm
  • High 8.1
    CVE-2026-28291

    simple-git has Command Execution via Option-Parsing Bypass

    simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The …

    steveukx git-js simple-git npm
  • Critical 9.8
    CVE-2026-28292

    simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE

    `simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on …

    steveukx simple-git simple-git npm
  • High 8.1
    CVE-2022-25860

    Remote code execution in simple-git

    Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912]…

    simple-git npm
  • High 8.1
    CVE-2022-25912

    Remote Code Execution (RCE)

    The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security…

    simple-git npm
  • High 8.1
    CVE-2022-24066

    Command Injection

    The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload…

    simple-git npm
  • High 8.1
    CVE-2022-24433

    Command Injection

    The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git op…

    simple-git npm