{"vulnerability": "GHSA-x6jw-m9v5-85vh", "sightings": [{"uuid": "99481a4f-926f-4ddb-a845-ca8549539fa2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-x6jw-m9v5-85vh", "type": "seen", "source": "https://gist.github.com/alon710/112c0d45812adcf793848c37458c68de", "content": "# CVE-2026-102828: CVE-2026-102828: Remote Code Execution via Configuration and Argument Injection in simple-git\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102828\n\n## Summary\nA critical remote code execution vulnerability (CVE-2026-102828) exists in simple-git versions 3.15.0 through 4.0.0. The vulnerability is caused by an incomplete blocklist within the library's default safety enforcement plugin, blockUnsafeOperationsPlugin. Attackers who can control Git configuration arguments or supply command flags to rebase operations can execute arbitrary system commands with the privileges of the parent Node.js process.\n\n## TL;DR\nIncomplete configuration blocklists and argument parsing discrepancies in simple-git prior to version 4.0.1 allow remote attackers to achieve arbitrary shell command execution via trailer commands and rebase parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78, CWE-184\n- **Attack Vector**: Network\n- **CVSS Base Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00275 (0.27% probability of exploitation)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications integrating simple-git prior to version 4.0.1\n- **simple-git**: >= 3.15.0, < 4.0.1 (Fixed in: `4.0.1`)\n\n## Mitigation\n\n- Upgrade simple-git to version 4.0.1 or higher immediately.\n- Enforce strict options configuration disabling all unsafe command binaries and exec configurations.\n- Apply strict input validation blocklists or allowlists on all properties passed to simple-git configuration parameters.\n\n**Remediation Steps:**\n1. Identify all Node.js projects utilizing the npm package simple-git.\n2. Update package dependencies in package.json to reflect simple-git version >= 4.0.1.\n3. Verify that simpleGit options do not explicitly set allowUnsafeCommandBinaries or allowUnsafeExec to true.\n4. Run regression tests on applications using the library to confirm compatibility with the 4.0.1 engine.\n\n## References\n\n- [CVE Official Record](https://www.cve.org/CVERecord?id=CVE-2026-102828)\n- [NVD Directory Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-102828)\n- [GitHub Security Advisory](https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh)\n- [Official Security Patch Commit](https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3)\n- [GitHub Pull Request #1198](https://github.com/steveukx/git-js/pull/1198)\n- [Release simple-git@4.0.1 Tag](https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102828) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T05:30:32.000000Z"}, {"uuid": "618414d9-cc03-4389-a313-4bffe35152f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-x6jw-m9v5-85vh", "type": "seen", "source": "https://gist.github.com/sonofmagic/384d7a9eed232a8ec81daddf0a3280bb", "content": "# \u5df2\u89c2\u5bdf\u5230\u7684\u7ed3\u679c\uff082026-10-09\uff09\n\n## \u5b89\u88c5\n\nrepoctl 5.9.0 \u4e0e @icebreakers/monorepo 5.9.0 \u5b89\u88c5\u6210\u529f\u3002\n\n## Peer \u68c0\u67e5\uff08\u9000\u51fa\u7801 1\uff09\n\n```text\nIssues with peer dependencies found\n\n\u2715 unmet peer @pnpm/logger\n  Installed: 1100.0.0\n  Wanted:\n    \">=1001.0.0 <1002.0.0\":\n      @pnpm/core-loggers@1001.0.9\n    ^1001.0.1:\n      @pnpm/read-project-manifest@1001.2.6\n      @pnpm/manifest-utils@1002.0.5\n```\n\n## \u5b89\u5168\u5ba1\u8ba1\uff08\u9000\u51fa\u7801 1\uff09\n\n4 critical / 3 high / 0 moderate / 1 low\uff1b\u5171 8 \u6761\u516c\u5f00 advisory\uff0c\u5e76\u975e 8 \u4e2a\u72ec\u7acb\u5305\u3002\n\n| \u5305 | \u5b89\u88c5\u7248\u672c | \u4e25\u91cd\u7a0b\u5ea6 | Advisory | \u4fee\u590d\u7248\u672c |\n| --- | --- | --- | --- | --- |\n| `braces` | `3.0.3` | high | [GHSA-vfj7-8cjw-p6xm](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm) | \u5c1a\u65e0\u5df2\u53d1\u5e03\u4fee\u590d\u7248 |\n| `@simple-git/argv-parser` | `1.1.1` | critical | [GHSA-v5rq-49vh-5v5c](https://github.com/advisories/GHSA-v5rq-49vh-5v5c) | >=2.0.1 |\n| `simple-git` | `3.36.0` | critical | [GHSA-x6jw-m9v5-85vh](https://github.com/advisories/GHSA-x6jw-m9v5-85vh) | >=4.0.1 |\n| `simple-git` | `3.36.0` | high | [GHSA-g4wm-2vf7-vfgr](https://github.com/advisories/GHSA-g4wm-2vf7-vfgr) | >=4.0.0 |\n| `simple-git` | `3.36.0` | high | [GHSA-858h-whjf-mvg5](https://github.com/advisories/GHSA-858h-whjf-mvg5) | >=4.0.0 |\n| `katex` | `0.16.47` | low | [GHSA-238p-pmpm-9mq7](https://github.com/advisories/GHSA-238p-pmpm-9mq7) | >=0.18.2 |\n| `tinypool` | `2.1.0` | critical | [GHSA-5gmw-xhrv-c9v3](https://github.com/advisories/GHSA-5gmw-xhrv-c9v3) | >=2.1.1 |\n| `tinypool` | `2.1.0` | critical | [GHSA-85c8-ppgw-ccpr](https://github.com/advisories/GHSA-85c8-ppgw-ccpr) | >=2.1.2 |\n\n## \u4f9d\u8d56\u6765\u6e90\n\n```text\n@pnpm/logger@1100.0.0\n\u251c\u2500\u252c @icebreakers/monorepo@5.9.0\n\u2502 \u2514\u2500\u252c repoctl@5.9.0\n\u2502   \u2514\u2500\u2500 repoctl-dependency-repro (devDependencies)\n\u251c\u2500\u252c @pnpm/core-loggers@1001.0.9\n\u2502 \u2514\u2500\u252c @pnpm/manifest-utils@1002.0.5\n\u2502   \u2514\u2500\u252c @pnpm/read-project-manifest@1001.2.6\n\u2502     \u2514\u2500\u252c @pnpm/fs.find-packages@1000.0.24\n\u2502       \u2514\u2500\u2500 @icebreakers/monorepo@5.9.0 [deduped]\n\u251c\u2500\u252c @pnpm/core-loggers@1101.0.2\n\u2502 \u251c\u2500\u252c @pnpm/fs.indexed-pkg-importer@1100.0.33\n\u2502 \u2502 \u2514\u2500\u252c @pnpm/store.create-cafs-store@1100.0.34\n\u2502 \u2502   \u2514\u2500\u252c @pnpm/worker@1100.4.8\n\u2502 \u2502     \u2514\u2500\u2500 @icebreakers/monorepo@5.9.0 [deduped]\n\u2502 \u2514\u2500\u252c @pnpm/fs.symlink-dependency@1100.0.24\n\u2502   \u2514\u2500\u2500 @pnpm/worker@1100.4.8 [deduped]\n\u251c\u2500\u252c @pnpm/fs.hard-link-dir@1100.0.9\n\u2502 \u2514\u2500\u2500 @pnpm/worker@1100.4.8 [deduped]\n\u251c\u2500\u2500 @pnpm/fs.indexed-pkg-importer@1100.0.33 [deduped]\n\u251c\u2500\u2500 @pnpm/fs.symlink-dependency@1100.0.24 [deduped]\n\u251c\u2500\u2500 @pnpm/manifest-utils@1002.0.5 [deduped]\n\u251c\u2500\u2500 @pnpm/read-project-manifest@1001.2.6 [deduped]\n\u251c\u2500\u2500 @pnpm/store.create-cafs-store@1100.0.34 [deduped]\n\u2514\u2500\u2500 @pnpm/worker@1100.4.8 [deduped]\n\n@simple-git/argv-parser@1.1.1\n\u2514\u2500\u252c simple-git@3.36.0\n  \u2514\u2500\u252c @icebreakers/monorepo@5.9.0\n    \u2514\u2500\u252c repoctl@5.9.0\n      \u2514\u2500\u2500 repoctl-dependency-repro (devDependencies)\n\nkatex@0.16.47\n\u2514\u2500\u252c micromark-extension-math@3.1.0\n  \u2514\u2500\u252c @eslint/markdown@8.0.3\n    \u2514\u2500\u252c @antfu/eslint-config@9.5.1\n      \u2514\u2500\u252c @icebreakers/eslint-config@8.0.8\n        \u2514\u2500\u252c @icebreakers/monorepo@5.9.0\n          \u2514\u2500\u252c repoctl@5.9.0\n            \u2514\u2500\u2500 repoctl-dependency-repro (devDependencies)\n\nsimple-git@3.36.0\n\u2514\u2500\u252c @icebreakers/monorepo@5.9.0\n  \u2514\u2500\u252c repoctl@5.9.0\n    \u2514\u2500\u2500 repoctl-dependency-repro (devDependencies)\n\ntinypool@2.1.0\n\u2514\u2500\u252c oxfmt@0.35.0\n  \u2514\u2500\u252c eslint-plugin-format@2.0.1\n    \u251c\u2500\u252c @antfu/eslint-config@9.5.1\n    \u2502 \u2514\u2500\u252c @icebreakers/eslint-config@8.0.8\n    \u2502   \u2514\u2500\u252c @icebreakers/monorepo@5.9.0\n    \u2502     \u2514\u2500\u252c repoctl@5.9.0\n    \u2502       \u2514\u2500\u2500 repoctl-dependency-repro (devDependencies)\n    \u2514\u2500\u2500 @icebreakers/eslint-config@8.0.8 [deduped]\n\nFound 1 version of @pnpm/logger\nFound 1 version of @simple-git/argv-parser\nFound 1 version of katex\nFound 1 version of simple-git\nFound 1 version of tinypool\n```\n\n\u53e6\uff1abraces \u7684 repoctl \u8def\u5f84\u4e3a `repoctl \u2192 @icebreakers/monorepo \u2192 micromatch \u2192 braces`\uff0c\u4e5f\u6709\u7ecf stylelint \u5f15\u5165\u7684\u8def\u5f84\u3002\n", "creation_timestamp": "2026-10-09T08:52:49.000000Z"}]}