Critical 9.2Published Sep 29, 2026

CVE-2026-102828simple-git unsafe-operation guard does not block trailer command configuration

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects steveukx git-js and 1 other product. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.38%, higher than 29% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for steveukx git-js

Exploited in the last 30 days

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.

CVSS: 9.2 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-78, CWE-184
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.38% (percentile 29)
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Sep 30, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

steveukx git-js steveukx:git_js (from the name)	from 3.15.0, < 4.0.1	CNA record
simple-git_project simple-git simple-git_project:simple-git	from 3.15.0 before 4.0.1	NVD

References

https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vhx-refsource-confirm, mitigation, vendor-advisory
https://github.com/steveukx/git-js/pull/1198x-refsource-misc, patch
https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3x-refsource-misc, patch
https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.1x-refsource-misc, release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.