{"vulnerability": "CVE-2026-102828", "sightings": [{"uuid": "00e66e23-9367-422f-a3ef-c55e7456218a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102828", "type": "seen", "source": "https://gist.github.com/alon710/112c0d45812adcf793848c37458c68de", "content": "# CVE-2026-102828: CVE-2026-102828: Remote Code Execution via Configuration and Argument Injection in simple-git\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102828\n\n## Summary\nA critical remote code execution vulnerability (CVE-2026-102828) exists in simple-git versions 3.15.0 through 4.0.0. The vulnerability is caused by an incomplete blocklist within the library's default safety enforcement plugin, blockUnsafeOperationsPlugin. Attackers who can control Git configuration arguments or supply command flags to rebase operations can execute arbitrary system commands with the privileges of the parent Node.js process.\n\n## TL;DR\nIncomplete configuration blocklists and argument parsing discrepancies in simple-git prior to version 4.0.1 allow remote attackers to achieve arbitrary shell command execution via trailer commands and rebase parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78, CWE-184\n- **Attack Vector**: Network\n- **CVSS Base Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00275 (0.27% probability of exploitation)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications integrating simple-git prior to version 4.0.1\n- **simple-git**: >= 3.15.0, < 4.0.1 (Fixed in: `4.0.1`)\n\n## Mitigation\n\n- Upgrade simple-git to version 4.0.1 or higher immediately.\n- Enforce strict options configuration disabling all unsafe command binaries and exec configurations.\n- Apply strict input validation blocklists or allowlists on all properties passed to simple-git configuration parameters.\n\n**Remediation Steps:**\n1. Identify all Node.js projects utilizing the npm package simple-git.\n2. Update package dependencies in package.json to reflect simple-git version >= 4.0.1.\n3. Verify that simpleGit options do not explicitly set allowUnsafeCommandBinaries or allowUnsafeExec to true.\n4. Run regression tests on applications using the library to confirm compatibility with the 4.0.1 engine.\n\n## References\n\n- [CVE Official Record](https://www.cve.org/CVERecord?id=CVE-2026-102828)\n- [NVD Directory Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-102828)\n- [GitHub Security Advisory](https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh)\n- [Official Security Patch Commit](https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3)\n- [GitHub Pull Request #1198](https://github.com/steveukx/git-js/pull/1198)\n- [Release simple-git@4.0.1 Tag](https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102828) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T05:30:32.000000Z"}, {"uuid": "87f22975-8a60-4671-acd5-8ccacdfa0c74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102828", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxbktsntt422", "content": "CVE-2026-102828 - git-js\nThe simple-git library does not block a special Git setting called trailer..cmd, which can run shell commands. If an application passes untrusted data into simple-git\u2019s\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gitjs #steveukx #npm #CVE #infosec", "creation_timestamp": "2026-10-07T08:50:05.485680Z"}]}