CVE-2026-102826 in git-js
Summary
by MITRE • 09/29/2026
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in simple-git versions prior to 4.0.0 represents a critical security flaw within the library's handling of Git configuration files during clone operations. Simple-git serves as an interface for executing git commands from Node.js applications, and its default blockUnsafeOperationsPlugin is designed to mitigate risks associated with unsafe Git configurations. However, this plugin fails to completely reject configuration includes when they are supplied through customArgs in the git.clone() function. Specifically, the missing classification of include.path allows an attacker-controlled configuration file to be loaded by Git during the cloning process. This oversight creates a pathway for arbitrary code execution if the application passes user-influenced arguments that can manipulate these configurations.
The technical mechanism behind this vulnerability relies on Git's ability to load external configuration files via the include directive. When simple-git invokes git clone with custom arguments, it inadvertently permits the inclusion of paths specified by an attacker. If the Node.js process has read access to a file controlled by an adversary, that file can contain malicious configurations such as setting core.sshCommand or other executable Git options. During the execution of the clone operation, Git will invoke these configured commands with the privileges of the running Node.js process. This effectively allows for remote code execution under the context of the application's user account, potentially leading to full system compromise depending on the permissions granted to that process.
The initial remediation attempt addressed only a portion of this issue by blocking standard include.path directives but failed to cover conditional includes such as includeIf.<condition>.path. This gap allows attackers to bypass the fix using alternative Git configuration syntaxes that achieve the same file-loading primitive. The exploitation scenario requires two primary conditions: first, the application must pass attacker-influenced custom arguments to the git clone function; second, an attacker-controlled file must exist in a location accessible by the Node.js process. Once these conditions are met, the malicious configuration is loaded and executed during the Git operation, leading to unauthorized command execution.
This vulnerability aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection), as it allows an attacker to inject arbitrary commands through misconfigured inputs that are subsequently interpreted by a system component. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1059 Command and Scripting Interpreter, specifically where the interpreter is invoked via configuration files rather than direct script execution. The attack vector leverages the trust relationship between the application and its environment to escalate privileges or execute arbitrary code without explicit user interaction beyond providing input parameters.
To mitigate this risk, organizations using simple-git must upgrade immediately to version 4.0.0 or later, where both include.path and conditional includes like includeIf.<condition>.path are properly blocked by the blockUnsafeOperationsPlugin. Additionally, developers should enforce strict validation of all custom arguments passed to Git commands, ensuring that no user-supplied data can influence configuration file paths or contents. Implementing least-privilege principles for Node.js processes further reduces the impact if such a vulnerability were present in other components. Regular security audits and static analysis tools configured to detect unsafe command construction patterns should also be employed to prevent similar issues across the codebase.