Vulnerability Details CVE-2026-102828
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 18.2%
CVSS Severity
CVSS v3 Score 9.8
References
Products affected by CVE-2026-102828
-
cpe:2.3:a:simple-git_project:simple-git:3.15.0
-
cpe:2.3:a:simple-git_project:simple-git:3.15.1
-
cpe:2.3:a:simple-git_project:simple-git:3.16.0
-
cpe:2.3:a:simple-git_project:simple-git:3.16.1
-
cpe:2.3:a:simple-git_project:simple-git:3.17.0
-
cpe:2.3:a:simple-git_project:simple-git:3.18.0
-
cpe:2.3:a:simple-git_project:simple-git:3.19.0
-
cpe:2.3:a:simple-git_project:simple-git:3.19.1
-
cpe:2.3:a:simple-git_project:simple-git:3.20.0
-
cpe:2.3:a:simple-git_project:simple-git:3.21.0
-
cpe:2.3:a:simple-git_project:simple-git:3.22.0
-
cpe:2.3:a:simple-git_project:simple-git:3.23.0
-
cpe:2.3:a:simple-git_project:simple-git:3.24.0
-
cpe:2.3:a:simple-git_project:simple-git:3.25.0
-
cpe:2.3:a:simple-git_project:simple-git:3.26.0
-
cpe:2.3:a:simple-git_project:simple-git:3.27.0
-
cpe:2.3:a:simple-git_project:simple-git:3.28.0
-
cpe:2.3:a:simple-git_project:simple-git:3.30.0
-
cpe:2.3:a:simple-git_project:simple-git:3.31.1
-
cpe:2.3:a:simple-git_project:simple-git:3.32.0
-
cpe:2.3:a:simple-git_project:simple-git:3.32.1
-
cpe:2.3:a:simple-git_project:simple-git:3.32.2
-
cpe:2.3:a:simple-git_project:simple-git:3.32.3
-
cpe:2.3:a:simple-git_project:simple-git:3.33.0