Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-9tyq-hrn5-4kbn
Vulnerability ID VCID-9tyq-hrn5-4kbn
Aliases CVE-2026-28291
GHSA-jcxm-m3jx-f287
Summary simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28291.json
epss 0.00156 https://api.first.org/data/v1/epss?cve=CVE-2026-28291
epss 0.00156 https://api.first.org/data/v1/epss?cve=CVE-2026-28291
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-jcxm-m3jx-f287
cvssv3.1 8.1 https://github.com/steveukx/git-js
generic_textual HIGH https://github.com/steveukx/git-js
cvssv3.1 8.1 https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26
generic_textual HIGH https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26
ssvc Track* https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26
cvssv3.1 8.1 https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d
generic_textual HIGH https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d
ssvc Track* https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d
cvssv3.1 8.1 https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0
generic_textual HIGH https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0
ssvc Track* https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0
cvssv3.1 8.1 https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287
cvssv3.1_qr HIGH https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287
generic_textual HIGH https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287
ssvc Track* https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2026-28291
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-28291
cvssv3.1 8.1 https://www.cve.org/CVERecord?id=CVE-2022-25860
generic_textual HIGH https://www.cve.org/CVERecord?id=CVE-2022-25860
ssvc Track* https://www.cve.org/CVERecord?id=CVE-2022-25860
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28291.json
https://api.first.org/data/v1/epss?cve=CVE-2026-28291
https://github.com/steveukx/git-js
https://nvd.nist.gov/vuln/detail/CVE-2026-28291
1effd8e5012a5da05a9776512fac3e39b11f2d2d https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d
2457930 https://bugzilla.redhat.com/show_bug.cgi?id=2457930
block-unsafe-operations-plugin.ts#L26 https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26
CVERecord?id=CVE-2022-25860 https://www.cve.org/CVERecord?id=CVE-2022-25860
GHSA-jcxm-m3jx-f287 https://github.com/advisories/GHSA-jcxm-m3jx-f287
GHSA-jcxm-m3jx-f287 https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287
simple-git%403.32.0 https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28291.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/steveukx/git-js
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-14T13:53:36Z/ Found at https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-14T13:53:36Z/ Found at https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-14T13:53:36Z/ Found at https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-14T13:53:36Z/ Found at https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-28291
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.cve.org/CVERecord?id=CVE-2022-25860
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-14T13:53:36Z/ Found at https://www.cve.org/CVERecord?id=CVE-2022-25860
Exploit Prediction Scoring System (EPSS)
Percentile 0.36169
EPSS Score 0.00156
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:43:58.444090+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/28xxx/CVE-2026-28291.json 38.6.0