{"id":"CVE-2026-102828","title":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript","summary":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<tok…","severity":"critical","cvss":9.2,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-78","CWE-184"],"vendor":"steveukx","product":"git-js","affected":["git-js >= 3.15.0, < 4.0.1"],"published":"2026-09-29","updated":"2026-09-29","sourceUpdated":"2026-09-29T19:17:25.207","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102828","references":[{"url":"https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3","label":"security-advisories@github.com"},{"url":"https://github.com/steveukx/git-js/pull/1198","label":"security-advisories@github.com"},{"url":"https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.1","label":"security-advisories@github.com"},{"url":"https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"cvssSource":"cna","ingestedAt":"2026-09-29T19:44:04.149Z","slug":"CVE-2026-102828","body":"## Overview\n\nsimple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":50.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}