CVE-2026-102827

Analyzed Analyzed - Analysis Complete

Remote Code Execution in Simple-Git Library

Publication date: 2026-09-29

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102827

EUVD

EUVD-2026-89333

Affected Vendors & Products

Vendor	Product	Version / Range
simple-git_project	simple-git	to 4.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-102827 is a command execution vulnerability in the simple-git npm package affecting versions before 4.0.0. The issue occurs because the library's blockUnsafeOperationsPlugin checks for literal dangerous Git option spellings like --receive-pack but fails to block unambiguous abbreviated forms such as --receive-p or --exe. Attackers can exploit this by using these abbreviated options in push arguments to bypass security checks and execute arbitrary commands via Git operations.

Detection Guidance

To detect this vulnerability, check if your system uses simple-git versions <= 3.36.0. Run 'npm list simple-git' or 'npm ls simple-git' to verify the installed version. If vulnerable, update to version 4.0.0 or later. Inspect Git commands for abbreviated options like --receive-p or --exe in logs or scripts.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on systems using vulnerable versions of simple-git. If your application uses simple-git to interact with Git repositories and accepts user-controlled input for Git operations, an attacker could manipulate commands to run malicious code. This could lead to data theft, system compromise, or further network infiltration depending on the permissions of the application.

Compliance Impact

This vulnerability could lead to unauthorized command execution, potentially violating data confidentiality and integrity requirements under GDPR and HIPAA. If exploited, it may result in unauthorized access to personal or health data, triggering mandatory breach notifications and regulatory penalties. Organizations must ensure they upgrade to version 4.0.0 or later to maintain compliance.

Mitigation Strategies

Immediately upgrade simple-git to version 4.0.0 or later using 'npm update simple-git' or 'npm install simple-git@latest'. Review Git operations for unsafe configurations and remove any abbreviated options. Set GIT_TEST_DISALLOW_ABBREVIATED_OPTIONS=1 to disable abbreviated options globally.

Hi! I’m here to help you understand CVE-2026-102827. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70