Skip to content
OpenAdvisories

Package · npm

simple-git

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-102828

    simple-git unsafe-operation guard does not block trailer command configuration

    simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe conf…

    steveukx git-js simple-git npm
  • Critical 9.8
    CVE-2026-6951 Public exploit

    simple-git is vulnerable to Remote Code Execution

    Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config for…

    simple-git npm
  • Critical 9.8
    CVE-2026-28292

    simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE

    `simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on …

    steveukx simple-git simple-git npm