{"id":"EUVD-2026-22026","revision":"5d2fa1947e4445ddbb8d4c73c38174ed","records":[{"revision":"5d2fa1947e4445ddbb8d4c73c38174ed","observedAt":"2026-10-30T03:55:34.956+00:00","statement":{"source":"euvd","id":"EUVD-2026-22026","aliases":["CVE-2026-28291","GHSA-jcxm-m3jx-f287"],"title":"simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and …","description":"simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":null}],"references":["https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287","https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d","https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26","https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0","https://www.cve.org/CVERecord?id=CVE-2022-25860"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22026","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 13, 2026, 5:15:14 PM","dateUpdated":"Jul 15, 2026, 1:11:56 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-22026","identifiers":["EUVD-2026-22026","CVE-2026-28291","GHSA-jcxm-m3jx-f287"]},"retained":false,"historicalAffected":[]}],"coverage":[]}