Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-6951 EUVD-2026-25639GHSA-hffm-xvc3-vprc

simple-git is vulnerable to Remote Code Execution

Published Apr 25, 2026 · Updated Sep 14, 2026 · Assigned by snyk

Package: renovate Package: simple-git Ecosystem: npm Ecosystem: Wolfi

Description

Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.

Affected products

VendorProductAffectedFixed
— simple-git < 3.36.0 3.36.0
— org.webjars.npm:simple-git — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling renovate 43.170.15-r2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm simple-git < 3.36.0 3.36.0 GHSA-hffm-xvc3-vprc

References