Skip to content
OpenAdvisories

Package · npm

simple-git

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.1
    CVE-2026-102827 Public exploit

    simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

    simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option sp…

    steveukx git-js simple-git npm
  • High 8.1
    CVE-2026-102826 Public exploit

    simple-git allows command execution through unblocked Git configuration includes

    simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied th…

    steveukx git-js simple-git npm
  • High 8.1
    CVE-2026-28291

    simple-git has Command Execution via Option-Parsing Bypass

    simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The …

    steveukx git-js simple-git npm
  • High 8.1
    CVE-2022-25860

    Remote code execution in simple-git

    Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912]…

    simple-git npm
  • High 8.1
    CVE-2022-25912

    Remote Code Execution (RCE)

    The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security…

    simple-git npm
  • High 8.1
    CVE-2022-24066

    Command Injection

    The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload…

    simple-git npm
  • High 8.1
    CVE-2022-24433

    Command Injection

    The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git op…

    simple-git npm