Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/50817?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50817?format=api", "vulnerability_id": "VCID-epz2-6ye6-bfay", "summary": "simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE\nThe `blockUnsafeOperationsPlugin` in `simple-git` fails to block git protocol\noverride arguments when the config key is passed in uppercase or mixed case.\nAn attacker who controls arguments passed to git operations can enable the\n`ext::` protocol by passing `-c PROTOCOL.ALLOW=always`, which executes an\narbitrary OS command on the host machine.\n\n---\n\n\n| # | Vector | Payload | Sentinel file | Result |\n|---|--------|---------|---------------|--------|\n| 1 | CVE-2022-25912 original | `protocol.ext.allow=always` (lowercase) | not created | Blocked ✅ |\n| 2 | Case-sensitivity bypass | `PROTOCOL.ALLOW=always` (uppercase) | `/tmp/pwn-codeant` created | **RCE ⚠️** |\n| 3 | Real-world app scenario | `PROTOCOL.ALLOW=always` + attacker URL | `/tmp/pwn-realworld` created | **RCE ⚠️** |\n\nThe case-sensitive regex in `preventProtocolOverride` blocks `protocol.*.allow` but does not account for uppercase or mixed-case variants. Git accepts all variants identically due to case-insensitive config key normalisation, allowing full bypass of the protection in all versions of simple-git that carry the 2022 fix.\n\n`/tmp/pwned` is created by the git subprocess via the `ext::` protocol.\n\nAll of the following bypass the check:\n\n| Argument passed via `-c` | Regex matches? | Git honours it? |\n|--------------------------|:--------------:|:---------------:|\n| `protocol.allow=always` | ✅ blocked | ✅ |\n| `PROTOCOL.ALLOW=always` | ❌ bypassed | ✅ |\n| `Protocol.Allow=always` | ❌ bypassed | ✅ |\n| `PROTOCOL.allow=always` | ❌ bypassed | ✅ |\n| `protocol.ALLOW=always` | ❌ bypassed | ✅ |\n\n---", "aliases": [ { "alias": "CVE-2026-28292" }, { "alias": "GHSA-r275-fr43-pm7q" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74660?format=api", "purl": "pkg:npm/simple-git@3.32.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/simple-git@3.32.3" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74659?format=api", "purl": "pkg:npm/simple-git@3.15.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-epz2-6ye6-bfay" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/simple-git@3.15.0" } ], "references": [ { "reference_url": "https://github.com/steveukx/git-js", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/steveukx/git-js" }, { "reference_url": "https://github.com/steveukx/git-js/commit/f7042088aa2dac59e3c49a84d7a2f4b26048a257", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/steveukx/git-js/commit/f7042088aa2dac59e3c49a84d7a2f4b26048a257" }, { "reference_url": "https://www.codeant.ai/security-research/security-research-simple-git-remote-code-execution-cve-2026-28292", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.codeant.ai/security-research/security-research-simple-git-remote-code-execution-cve-2026-28292" }, { "reference_url": "https://www.codeant.ai/security-research/simple-git-remote-code-execution-cve-2026-28292", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.codeant.ai/security-research/simple-git-remote-code-execution-cve-2026-28292" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28292", "reference_id": "CVE-2026-28292", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28292" }, { "reference_url": "https://github.com/advisories/GHSA-r275-fr43-pm7q", "reference_id": "GHSA-r275-fr43-pm7q", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-r275-fr43-pm7q" }, { "reference_url": "https://github.com/steveukx/git-js/security/advisories/GHSA-r275-fr43-pm7q", "reference_id": "GHSA-r275-fr43-pm7q", "reference_type": "", "scores": [], "url": "https://github.com/steveukx/git-js/security/advisories/GHSA-r275-fr43-pm7q" } ], "weaknesses": [ { "cwe_id": 178, "name": "Improper Handling of Case Sensitivity", "description": "The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results." }, { "cwe_id": 78, "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "description": "The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": null, "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-epz2-6ye6-bfay" }