GHSA-r275-fr43-pm7q — simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE

Affected: npm: simple-git

### Summary

The `blockUnsafeOperationsPlugin` in `simple-git` fails to block git protocol override arguments when the config key is passed in uppercase or mixed case. An attacker who controls arguments passed to git operations can enable the `ext::` protocol by passing `-c PROTOCOL.ALLOW=always`, which executes an arbitrary OS command on the host machine.

---

### Details

The `preventProtocolOverride` function in `simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts` (line 24) checks whether a `-c` argument configures `protocol.allow` using this regex:

```ts if (!/^\s*protocol(.[a-z]+)?.allow/.test(next)) { return; } ```

This regex is case-sensitive. Git treats config key names case-insensitively — it normalises them to lowercase internally. As a result, passing `PROTOCOL.ALLOW=always`, `Protocol.Allow=always`, or any mixed-case variant is not matched by the regex, the check returns without throwing, and git is spawned with the unsafe argument.

**Verification that git normalises the key:**

```bash $ git -c PROTOCOL.ALLOW=always config --list | grep protocol protocol.allow=always ```

**The fix is a single character — add the `/i` flag:**

```ts // Before (vulnerable): if (!/^\s*protocol(.[a-z]+)?.allow/.test(next)) {

// After (fixed): if (!/^\s*protocol(.[a-z]+)?.allow/i.test(next)) { ```

---

## poc.js

```js /** * Proof of Concept — simple-git preventProtocolOverride Case-Sensitivity Bypass * * CVE-2022-25912 was fixed in simple-git@3.15.0 by adding…

Most recent entries from all

GHSA-r275-fr43-pm7q — simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE