CVE-2026-102828 simple-git unsafe-operation guard does not block trailer command configuration
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-102828?
CVE-2026-102828 is a critical vulnerability in steveukx git-js, published on 29 Sep 2026.
Official description
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.
Which versions are affected by CVE-2026-102828?
2 open source packages ship an affected version, including simple-git. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
simple-git npm | From 3.15.0 | 4.0.1 |
simple-git npm | From 3.15.0 | 4.0.1 |
Products include Simple-Git Project Simple-Git.
How do I fix CVE-2026-102828?
Upgrade simple-git to 4.0.1 or later.
Is CVE-2026-102828 being exploited?
There is no known exploitation of CVE-2026-102828 in the wild and no public exploit code.
Other vulnerabilities in steveukx git-js
- CVE-2026-28292 simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE
- CVE-2026-6951 simple-git is vulnerable to Remote Code Execution
- CVE-2026-102826 simple-git allows command execution through unblocked Git configuration includes
- CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
- CVE-2026-28291 simple-git has Command Execution via Option-Parsing Bypass
Sources
Also known as CLEANSTART-2026-FS80263, CLEANSTART-2026-MR56986, GHSA-x6jw-m9v5-85vh, MINI-cgwx-j676-fqv2, MINI-x39m-79rm-wh6w, ROOT-APP-NPM-CVE-2026-102828.