{"vulnerability": "cve-2026-10282", "sightings": [{"uuid": "a018a62b-090a-4ad6-ae56-713912b90eb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102827", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwolsqcyrk27", "content": "\ud83d\udfe0 CVE-2026-102827 - High (8.1)\n\nsimple-git, an interface for running git commands in any node.js application, enables application...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-102827/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-29T19:46:48.817387Z"}, {"uuid": "e40f4f87-8e6c-4d67-8116-6eaeaa47888d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102823", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwolt6gman2c", "content": "\ud83d\udfe0 CVE-2026-102823 - High (7.5)\n\nRussh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-102823/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-29T19:47:03.587401Z"}, {"uuid": "05fb7c6f-3c09-4014-a128-3d4865c2e967", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102826", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwomp2w6br2d", "content": "\ud83d\udfe0 CVE-2026-102826 - High (8.1)\n\nsimple-git, an interface for running git commands in any node.js application, enables application...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-102826/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-29T20:02:39.573606Z"}, {"uuid": "91a8901a-2652-403e-b864-c6cb196febe4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-102820", "type": "published-proof-of-concept", "source": "https://github.com/Eugeny/russh/security/advisories/GHSA-g4mp-vgx3-xrvm", "content": "", "creation_timestamp": "2026-09-03T18:37:41.000000Z"}, {"uuid": "68124719-9918-4693-9925-02d6fbcd362f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-102821", "type": "published-proof-of-concept", "source": "https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw", "content": "", "creation_timestamp": "2026-09-03T18:37:50.000000Z"}, {"uuid": "8e962910-30ff-4088-ab0c-5eb801a627db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-102822", "type": "published-proof-of-concept", "source": "https://github.com/Eugeny/russh/security/advisories/GHSA-p8qx-h547-fjw9", "content": "", "creation_timestamp": "2026-08-23T18:19:41.000000Z"}, {"uuid": "acc036a3-e6d6-4d02-930c-0f9b263bb796", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-102824", "type": "published-proof-of-concept", "source": "https://github.com/Eugeny/russh/security/advisories/GHSA-w3jg-pjxf-73p4", "content": "", "creation_timestamp": "2026-08-21T13:29:25.000000Z"}, {"uuid": "430b83b7-1d02-4637-a4b4-f6468db8fb13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102820", "type": "seen", "source": "https://gist.github.com/alon710/b6f4cdc8370bc7031705c8ea315cfc78", "content": "# CVE-2026-102820: CVE-2026-102820: Out-of-Bounds Read and Excessive Memory Allocation in russh pageant\n\n> **CVSS Score:** 6.2\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102820\n\n## Summary\nA critical memory handling vulnerability exists in the pageant crate, a workspace component of the Rust-based russh SSH client library, during communication with the PuTTY Pageant SSH agent on Windows systems. Prior to version 0.2.3, the library's shared memory parsing logic blindly trusted a peer-controlled, 32-bit big-endian response length field. This allows local attackers running within the same user session to trigger out-of-bounds reads or execute an out-of-memory crash of the client application.\n\n## TL;DR\nUnvalidated 32-bit response length fields in the pageant crate allow a local process to cause an out-of-memory crash or perform out-of-bounds reads against russh-based clients.\n\n## Technical Details\n\n- **CWE ID**: CWE-125, CWE-789\n- **Attack Vector**: Local\n- **CVSS v3.1 Score**: 6.2 (Medium)\n- **EPSS Score**: 0.00129 (0.129% probability)\n- **Impact**: Denial of Service (DoS) and potential Information Disclosure\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- pageant crate on Windows operating systems\n- russh client library integrations on Windows operating systems\n- **pageant**: < 0.2.3 (Fixed in: `0.2.3`)\n- **russh**: >= 0.58.0, < 0.63.2 (Fixed in: `0.63.2`)\n\n## Mitigation\n\n- Update the cargo project dependencies immediately to use patched versions of the pageant and russh libraries.\n- Isolate automated SSH tasks on Windows within separate containerized virtual contexts to avoid local window messaging interference.\n- Utilize cargo-audit in build pipelines to block deployment of vulnerable dependencies.\n\n**Remediation Steps:**\n1. Locate the cargo workspace file containing dependencies on the pageant or russh crates.\n2. Run 'cargo update -p pageant' and 'cargo update -p russh' to update to fixed versions.\n3. Verify that pageant is updated to at least 0.2.3 and russh is updated to at least 0.63.2.\n4. Run 'cargo audit' to ensure that no further references to the vulnerable library versions remain in your local dependency trees.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/Eugeny/russh/security/advisories/GHSA-g4mp-vgx3-xrvm)\n- [Fix Patch Commit](https://github.com/Eugeny/russh/commit/5d566989ebabfdebfe6b33243d31765a0812260b)\n- [NVD CVE Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-102820)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-102820)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102820) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T13:30:28.000000Z"}, {"uuid": "0eaf8f59-a1fb-409c-b0f7-8a1ec08fc073", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102821", "type": "seen", "source": "https://gist.github.com/alon710/1a59d9122240df924fd1e8ee7c340f6b", "content": "# CVE-2026-102821: CVE-2026-102821: Unbounded Memory Exhaustion via CHANNEL_OPEN Flood in russh\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102821\n\n## Summary\nAn uncontrolled resource consumption vulnerability in the russh library allows remote authenticated attackers to exhaust server memory (heap) by flooding channel open requests during a stalled key re-exchange (rekeying) process, causing a denial of service via Out-of-Memory (OOM) termination.\n\n## TL;DR\nAuthenticated remote peers can trigger unbounded memory growth in russh by starting a rekey, stalling the handshake, and flooding connection-layer packets which accumulate in an undrained heap queue.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.5 (Medium)\n- **EPSS Score**: 0.00295\n- **Exploit Status**: No public functional exploit\n- **KEV Status**: Not listed in CISA KEV\n- **Impact**: Denial of Service (Memory Exhaustion / Crash)\n\n## Affected Systems\n\n- Applications and services utilizing the russh SSH library prior to version 0.63.2\n- **russh**: >= 0.58.0, < 0.63.2 (Fixed in: `0.63.2`)\n\n## Mitigation\n\n- Upgrade the russh dependency to version 0.63.2 or later.\n- Configure aggressive inactivity timeouts on SSH connections.\n- Apply network-layer rate limiting on incoming connection flows.\n\n**Remediation Steps:**\n1. Open the Cargo.toml file of your project.\n2. Locate the russh dependency and update the version string to '0.63.2' or later.\n3. Execute the command 'cargo update -p russh' in the terminal to update the lockfile.\n4. Rebuild and redeploy the application.\n\n## References\n\n- [GitHub Security Advisory (GHSA-35g8-35p8-c8fw)](https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw)\n- [Official Fix Commit](https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b)\n- [Official Release Announcement (v0.63.2)](https://github.com/Eugeny/russh/releases/tag/v0.63.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102821) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T14:30:31.000000Z"}, {"uuid": "c21f153c-ddae-40cd-b4d6-f8739f8dee7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-102829", "type": "published-proof-of-concept", "source": "https://github.com/steveukx/git-js/security/advisories/GHSA-v5rq-49vh-5v5c", "content": "", "creation_timestamp": "2026-09-26T14:23:33.000000Z"}, {"uuid": "29176c8b-6d55-4c72-86bc-ad9b6cbe24bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-102826", "type": "published-proof-of-concept", "source": "https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr", "content": "", "creation_timestamp": "2026-09-26T07:42:47.000000Z"}, {"uuid": "4d9a32dc-ee0a-4226-bac1-e5f7481e2525", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102829", "type": "seen", "source": "https://gist.github.com/alon710/a68f146c2be91af7aba5098416de5c67", "content": "# CVE-2026-102829: CVE-2026-102829: Security Control Bypass and Command Injection via VISUAL Environment Variable in @simple-git/argv-parser\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102829\n\n## Summary\nA critical security control bypass vulnerability exists in @simple-git/argv-parser before version 2.0.1. The package fails to map the VISUAL environment variable to the allowUnsafeEditor rule, allowing attackers who control environment parameters to execute arbitrary commands when Git triggers an interactive editor fallback.\n\n## TL;DR\nOmission of the VISUAL environment variable from the GitEnvKeys lookup registry allows an attacker-controlled VISUAL variable to bypass simple-git security checks, leading to arbitrary command execution when Git falls back to an interactive editor.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78 / CWE-184\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00275 (Percentile: 18.07%)\n- **Impact**: Unauthenticated Remote Code Execution\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications using simple-git with untrusted environment variables\n- Applications using @simple-git/argv-parser < 2.0.1\n- **@simple-git/argv-parser**: < 2.0.1 (Fixed in: `2.0.1`)\n- **simple-git**: < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Upgrade @simple-git/argv-parser to version 2.0.1 or higher.\n- Sanitize and strip environment parameters (VISUAL, EDITOR, GIT_EDITOR) before passing them to simple-git.\n- Enforce a static high-priority editor configuration like GIT_EDITOR=true.\n\n**Remediation Steps:**\n1. Identify all applications utilizing simple-git or @simple-git/argv-parser.\n2. Execute 'npm update @simple-git/argv-parser' or 'npm install simple-git@latest'.\n3. Verify that the dependency tree resolves @simple-git/argv-parser to version 2.0.1 or above.\n4. Optionally implement input sanitization to strip user-controlled environment keys.\n\n## References\n\n- [CVE-2026-102829 Record](https://www.cve.org/CVERecord?id=CVE-2026-102829)\n- [NVD - CVE-2026-102829](https://nvd.nist.gov/vuln/detail/CVE-2026-102829)\n- [GitHub Security Advisory GHSA-v5rq-49vh-5v5c](https://github.com/steveukx/git-js/security/advisories/GHSA-v5rq-49vh-5v5c)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102829) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T04:30:32.000000Z"}, {"uuid": "00e66e23-9367-422f-a3ef-c55e7456218a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102828", "type": "seen", "source": "https://gist.github.com/alon710/112c0d45812adcf793848c37458c68de", "content": "# CVE-2026-102828: CVE-2026-102828: Remote Code Execution via Configuration and Argument Injection in simple-git\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102828\n\n## Summary\nA critical remote code execution vulnerability (CVE-2026-102828) exists in simple-git versions 3.15.0 through 4.0.0. The vulnerability is caused by an incomplete blocklist within the library's default safety enforcement plugin, blockUnsafeOperationsPlugin. Attackers who can control Git configuration arguments or supply command flags to rebase operations can execute arbitrary system commands with the privileges of the parent Node.js process.\n\n## TL;DR\nIncomplete configuration blocklists and argument parsing discrepancies in simple-git prior to version 4.0.1 allow remote attackers to achieve arbitrary shell command execution via trailer commands and rebase parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78, CWE-184\n- **Attack Vector**: Network\n- **CVSS Base Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00275 (0.27% probability of exploitation)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications integrating simple-git prior to version 4.0.1\n- **simple-git**: >= 3.15.0, < 4.0.1 (Fixed in: `4.0.1`)\n\n## Mitigation\n\n- Upgrade simple-git to version 4.0.1 or higher immediately.\n- Enforce strict options configuration disabling all unsafe command binaries and exec configurations.\n- Apply strict input validation blocklists or allowlists on all properties passed to simple-git configuration parameters.\n\n**Remediation Steps:**\n1. Identify all Node.js projects utilizing the npm package simple-git.\n2. Update package dependencies in package.json to reflect simple-git version >= 4.0.1.\n3. Verify that simpleGit options do not explicitly set allowUnsafeCommandBinaries or allowUnsafeExec to true.\n4. Run regression tests on applications using the library to confirm compatibility with the 4.0.1 engine.\n\n## References\n\n- [CVE Official Record](https://www.cve.org/CVERecord?id=CVE-2026-102828)\n- [NVD Directory Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-102828)\n- [GitHub Security Advisory](https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh)\n- [Official Security Patch Commit](https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3)\n- [GitHub Pull Request #1198](https://github.com/steveukx/git-js/pull/1198)\n- [Release simple-git@4.0.1 Tag](https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102828) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T05:30:32.000000Z"}, {"uuid": "9e4a64e4-ae97-43ac-b10e-fa9a8368e2ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102826", "type": "seen", "source": "https://gist.github.com/alon710/05873ca6bd41f996e1ec68cb18b2c0db", "content": "# CVE-2026-102826: CVE-2026-102826: Argument Validation Bypass and Command Injection in simple-git\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102826\n\n## Summary\nCVE-2026-102826 is a critical security vulnerability discovered in the simple-git library for Node.js, affecting all versions prior to v4.0.0. The vulnerability allows remote attackers to bypass the library's built-in argument validation rules using conditional configuration includes and abbreviated Command Line Interface (CLI) options. By injecting custom arguments into Git execution pipelines, an attacker can force the application to load a malicious local configuration file, resulting in arbitrary OS command execution under the privileges of the parent Node.js process.\n\n## TL;DR\nA flaw in simple-git permits attackers to inject malicious arguments via conditional Git configuration rules (includeIf) and abbreviated CLI options, leading to remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-77, CWE-78\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.1\n- **EPSS Score**: 0.0046 (Percentile: 37.65%)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- simple-git\n- @simple-git/argv-parser\n- @simple-git/args-pathspec\n- **simple-git**: < 4.0.0 (Fixed in: `4.0.0`)\n- **@simple-git/argv-parser**: < 1.1.1 (Fixed in: `1.1.1`)\n- **@simple-git/args-pathspec**: < 1.0.4 (Fixed in: `1.0.4`)\n\n## Mitigation\n\n- Upgrade simple-git to version 4.0.0 or higher immediately.\n- Avoid passing custom or user-influenced command-line arguments to lower-level execution APIs.\n- Cleanse and restrict the runtime execution environment of the Node.js application process.\n\n**Remediation Steps:**\n1. Update the project dependencies using your package manager: npm install simple-git@latest or yarn upgrade simple-git.\n2. Audit the codebase to identify usage of raw CLI input fields mapped to simple-git methods.\n3. Deploy process-level logging to capture spawned Git binary arguments in production environments.\n\n## References\n\n- [Fix Commit](https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7)\n- [GitHub Security Advisory](https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-102826)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102826) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T06:30:32.000000Z"}, {"uuid": "e4b9508a-b74b-4113-9f1d-cd287bfa23ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102827", "type": "seen", "source": "https://gist.github.com/alon710/7c1d1754c30e0500c12b9daffdbd49f6", "content": "# CVE-2026-102827: CVE-2026-102827: Command and Argument Injection Bypass in simple-git via Option Abbreviation\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102827\n\n## Summary\nCVE-2026-102827 is an argument injection bypass vulnerability in the node.js simple-git package where the default blockUnsafeOperationsPlugin fails to detect abbreviated Git command options. Attackers can bypass validations using prefixes like --receive-p or --exe, which native Git subsequently expands to dangerous options, leading to remote command execution.\n\n## TL;DR\nA validation mismatch allows command execution bypasses in simple-git by using abbreviated Git options such as --receive-p and --exe, which bypass blocklist filters but are fully executed by the underlying Git binary.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-88, CWE-77\n- **Attack Vector**: Network\n- **CVSS Base Score**: 8.1\n- **Exploit Maturity**: PoC\n- **Affected Component**: blockUnsafeOperationsPlugin\n- **Remediation Strategy**: GIT_TEST_DISALLOW_ABBREVIATED_OPTIONS\n\n## Affected Systems\n\n- Node.js environments deploying applications that integrate simple-git versions prior to 4.0.0\n- Systems executing server-side simple-git commands where parameters are derived from user-controlled inputs\n- **simple-git**: < 4.0.0 (Fixed in: `4.0.0`)\n\n## Mitigation\n\n- Upgrade simple-git to 4.0.0 or later to enable native abbreviation restriction.\n- Perform strict validation on user-supplied options, rejecting strings starting with a hyphen (-) unless matched against an allowlist.\n- Restrict execution context using container-level isolation and minimal privilege user configurations.\n\n**Remediation Steps:**\n1. Identify current simple-git version by running: npm list simple-git\n2. Update simple-git dependency in package.json to at least ^4.0.0\n3. Run npm install to pull down the patched package\n4. Verify that custom arguments are not explicitly utilizing dangerous abbreviation overrides in application code\n\n## References\n\n- [GHSA-858h-whjf-mvg5 Security Advisory](https://github.com/steveukx/git-js/security/advisories/GHSA-858h-whjf-mvg5)\n- [NVD CVE-2026-102827 Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-102827)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-102827)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102827) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T07:30:28.000000Z"}, {"uuid": "87f22975-8a60-4671-acd5-8ccacdfa0c74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102828", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxbktsntt422", "content": "CVE-2026-102828 - git-js\nThe simple-git library does not block a special Git setting called trailer..cmd, which can run shell commands. If an application passes untrusted data into simple-git\u2019s\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gitjs #steveukx #npm #CVE #infosec", "creation_timestamp": "2026-10-07T08:50:05.485680Z"}, {"uuid": "9b78fa7f-07dd-407d-a1b0-e82bb778d7e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102829", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxblfow34s2z", "content": "CVE-2026-102829 - git-js\nThe @simple\u2011git/argv-parser library used by simple\u2011git does not treat the VISUAL environment variable as a risky editor setting. Because VISUAL is dropped before safety checks,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gitjs #simplegit #npm #CVE #infosec", "creation_timestamp": "2026-10-07T09:00:05.489474Z"}]}