CVE-2026-102828

Analyzed Analyzed - Analysis Complete

Command Injection in Simple-Git via Git Trailer Configuration

Publication date: 2026-09-29

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102828

EUVD

EUVD-2026-89334

Affected Vendors & Products

Vendor	Product	Version / Range
simple-git_project	simple-git	From 3.15.0 (inc) to 4.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects the simple-git npm package versions between 3.15.0 and 4.0.0. It involves the default unsafe-operation guard failing to block the trailer.<token>.cmd configuration, allowing arbitrary shell commands to execute through Git's interpret-trailers feature when untrusted values are passed into SimpleGitOptions.config or Git inline configuration arguments like -c <key>=<value>. The command runs with the permissions of the Node.js process.

Detection Guidance

To detect this vulnerability, check if your system uses simple-git versions between 3.15.0 and 4.0.0. Run: npm list simple-git. If the version is within this range, the system is vulnerable. Additionally, inspect application code for usage of SimpleGitOptions.config or inline Git -c arguments that may pass untrusted values.

Impact Analysis

An attacker could exploit this to execute arbitrary shell commands on your system with the same permissions as the Node.js process running the application. This could lead to unauthorized file access, data exfiltration, or further system compromise depending on the process permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade simple-git to version 4.0.1 or later immediately. If upgrading is not possible, add trailer.<token>.cmd to the blocked configurations list or implement a default-deny policy for executable configuration keys. Review application code to ensure no untrusted values are passed to SimpleGitOptions.config or Git inline -c arguments.

Hi! I’m here to help you understand CVE-2026-102828. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70