CVE-2026-102829 in git-js
Summary
by MITRE • 09/29/2026
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it as allowUnsafeEditor. A consuming application that forwards attacker-influenced environment values can therefore allow Git to invoke an attacker-selected editor during operations such as commit amendment or interactive rebase when no higher-priority editor setting overrides VISUAL and Git's terminal prerequisites are met. The executable runs with the privileges of the Node.js process. This issue is fixed in argv-parser 2.0.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified within the simple-git ecosystem, specifically stemming from a flaw in its dependency argv-parser prior to version 2.0.1, represents a significant security risk related to environment variable handling and command injection vectors. Simple-git serves as an interface for executing Git commands within Node.js applications, allowing developers to perform various git operations directly from JavaScript code. The core issue lies in the parseEnv function of argv-parser, which is responsible for processing environmental variables before they are passed to underlying system processes. Specifically, this function omits the VISUAL environment variable from the list of recognized Git environment keys during its initial parsing phase. This omission has a cascading effect on subsequent security checks within the library's logic flow.
The operational impact of this flaw is realized through the prepareEnv function, which drops or fails to properly handle the VISUAL value before the vulnerabilityCheck mechanism can evaluate it against unsafe editor configurations. In standard Git workflows, variables such as EDITOR and VISUAL determine which text editor is launched for tasks like commit message editing, interactive rebases, or amend operations. When an application consumes simple-git and forwards attacker-influenced environment values to these functions, the flawed logic allows a malicious actor to inject arbitrary commands via the VISUAL variable. Because the security check that would normally classify this as allowUnsafeEditor is bypassed due to the prior omission of VISUAL from GitEnvKeys, Git proceeds to invoke the editor specified in the VISUAL variable without proper sanitization or restriction.
This vulnerability effectively enables a command injection attack where an attacker can execute arbitrary code on the host system with the privileges of the Node.js process running simple-git. The risk is particularly acute when dealing with operations that inherently require user interaction, such as commit amendment or interactive rebase, provided no higher-priority editor setting overrides VISUAL and Git's terminal prerequisites are met. By manipulating the environment variables passed to the application, an attacker can force Git to launch a malicious executable rather than a safe text editor. This aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, as well as CWE-94 Improper Control of Generation of Code, and maps to MITRE ATT&CK techniques related to command and script interpretation or execution via environment variables.
To mitigate this vulnerability, organizations must ensure that all instances of the argv-parser package are updated to version 2.0.1 or later, where the parsing logic correctly includes VISUAL in GitEnvKeys allowing for proper security classification. Additionally, developers should implement strict input validation and sanitization on any environment variables passed from external sources before they reach simple-git functions. It is also advisable to restrict the execution context of Node.js processes using least privilege principles, ensuring that even if an injection occurs, the potential damage is contained. Regular auditing of dependencies for known vulnerabilities in supply chain components like argv-parser is essential to maintaining a secure development environment and preventing unauthorized code execution through manipulated environmental inputs.