CVE-2026-102826

Analyzed Analyzed - Analysis Complete

Git Configuration Injection in simple-git

Publication date: 2026-09-29

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102826

EUVD

EUVD-2026-89332

Affected Vendors & Products

Vendor	Product	Version / Range
simple-git_project	simple-git	to 4.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in simple-git allows attackers to execute arbitrary commands by exploiting unsafe Git configuration options. The library fails to properly block include.path and includeIf.<condition>.path settings, which can load malicious Git config files. These files can set dangerous options like core.sshCommand to run attacker-controlled shell commands during Git operations.

Detection Guidance

To detect this vulnerability, check if your system uses simple-git version 3.36.0 or earlier. Run 'npm list simple-git' or 'yarn list simple-git' to verify the installed version. If vulnerable, inspect applications passing customArgs to git.clone() for unsafe configurations like include.path or includeIf variants.

Impact Analysis

If you use simple-git versions before 4.0.0, an attacker could execute arbitrary code on your system with the privileges of the Node.js process. This requires the application to pass attacker-controlled arguments to git.clone() and for the attacker to write a malicious Git config file that the process can read.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially compromising sensitive data. For GDPR, it may result in data breaches requiring notification. For HIPAA, it could expose protected health information, violating compliance requirements.

Mitigation Strategies

Upgrade simple-git to version 4.0.0 or later immediately. Review applications using simple-git to ensure no customArgs pass unsafe Git configurations. Audit environment variables passed to Git commands and restrict sensitive data exposure.

Hi! I’m here to help you understand CVE-2026-102826. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70