Skip to content
OpenAdvisories

Vendor

steveukx

6 known vulnerabilities.

Products

git-js 5 simple-git 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-102829

    simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

    simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value befor…

    steveukx git-js renovate keycloak-26.6-iamguarded-compat Wolfi npm
  • Critical 9.2
    CVE-2026-102828

    simple-git unsafe-operation guard does not block trailer command configuration

    simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe conf…

    steveukx git-js renovate keycloak-26.6-iamguarded-compat Wolfi npm
  • Critical 9.8
    CVE-2026-28292

    simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE

    `simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on …

    steveukx simple-git simple-git npm