CVE-2026-102829

Undergoing Analysis Undergoing Analysis - In Progress

Command Injection in simple-git via VISUAL Environment Variable

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it as allowUnsafeEditor. A consuming application that forwards attacker-influenced environment values can therefore allow Git to invoke an attacker-selected editor during operations such as commit amendment or interactive rebase when no higher-priority editor setting overrides VISUAL and Git's terminal prerequisites are met. The executable runs with the privileges of the Node.js process. This issue is fixed in argv-parser 2.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102829

EUVD

EUVD-2026-89336

Affected Vendors & Products

Vendor	Product	Version / Range
argv-parser	argv-parser	2.0.1
steveukx	@simple-git	argv-parser

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in simple-git's argv-parser package (before version 2.0.1) allows an attacker to bypass security controls by setting the VISUAL environment variable. Git uses VISUAL as a fallback editor, but the parser omitted it from checks for unsafe editor usage. This lets attackers force Git to execute arbitrary code during operations like commit amendment or rebase when no higher-priority editor is set.

Detection Guidance

Check if your system uses vulnerable versions of @simple-git/argv-parser (prior to 2.0.1). Run: npm list @simple-git/argv-parser. If version is below 2.0.1, the system is vulnerable. Also inspect environment variables for VISUAL being set and forwarded to Git operations.

Impact Analysis

If you use an affected version of simple-git in your application and forward untrusted environment variables to Git, an attacker could execute malicious binaries with the privileges of your Node.js process. This could lead to full system compromise, data theft, or unauthorized changes to your repositories.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating GDPR's integrity principle or HIPAA's security requirements for protecting sensitive data. Organizations using affected versions may face compliance violations if the flaw enables data breaches or unauthorized system access.

Mitigation Strategies

Update @simple-git/argv-parser to version 2.0.1 or later. Run: npm update @simple-git/argv-parser. Remove or sanitize VISUAL from forwarded environment variables to Git operations. Restrict user permissions where possible.

Hi! I’m here to help you understand CVE-2026-102829. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70