CVE-2026-102828 in simple-git
Summary
by MITRE • 09/29/2026
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified within simple-git versions ranging from 3.15.0 to 4.0.1 represents a critical security flaw rooted in improper input validation during Git configuration processing. Simple-git serves as an interface for executing git commands within Node.js applications, allowing developers to manage version control operations programmatically via JavaScript. The core issue lies in the default blockUnsafeOperationsPlugin, which is designed to prevent dangerous command injection by blocking unsafe configurations and arguments. However, this plugin failed to classify a specific configuration pattern involving trailer.<token>.cmd as unsafe. This oversight creates a pathway for attackers to bypass security controls when an application passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments.
The technical mechanism of the exploit relies on Git's interpret-trailers command, which is used to add, modify, or remove trailers in commit messages and other git objects. When an attacker supplies a crafted configuration value that matches the unblocked pattern trailer.<token>.cmd, Git interprets this as a valid configuration directive rather than a malicious input. Consequently, when the application triggers operations involving interpret-trailers, Git executes the command specified by the attacker-selected shell command. This execution occurs with the operating-system identity and permissions of the Node.js process running the application, effectively granting the attacker arbitrary code execution capabilities within the context of that process.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically involving OS command injection through configuration parameters. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, as it allows an attacker to leverage the system's shell capabilities for unauthorized actions. The impact is severe because it bypasses standard sandboxing or restriction mechanisms intended by the library’s security features. An application that does not strictly validate configuration inputs can be compromised, leading to data exfiltration, lateral movement within a network if the Node.js process has broader access, or complete system takeover depending on the privileges of the running service.
Mitigation strategies must focus on immediate version upgrades and rigorous input validation practices. The primary remediation is to upgrade simple-git to version 4.0.1 or later, where this specific classification gap in blockUnsafeOperationsPlugin has been addressed. For applications unable to update immediately due to compatibility constraints, developers should implement strict allow-listing for all configuration values passed through SimpleGitOptions.config and inline -c arguments. It is crucial to sanitize any user-supplied data before it reaches the git command interface, ensuring that no shell metacharacters or suspicious patterns like trailer.<token>.cmd can be injected. Additionally, running Node.js processes with minimal required privileges reduces the potential blast radius of such an exploitation attempt, adhering to the principle of least privilege in system architecture design.