Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-jrj3-d3uk-dfdh
Vulnerability ID VCID-jrj3-d3uk-dfdh
Aliases CVE-2026-6951
GHSA-hffm-xvc3-vprc
Summary Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-6951.json
epss 0.00213 https://api.first.org/data/v1/epss?cve=CVE-2026-6951
epss 0.00213 https://api.first.org/data/v1/epss?cve=CVE-2026-6951
cvssv3.1 9.8 https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6
cvssv3.1 9.8 https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6
cvssv4 8.2 https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6
cvssv4 9.2 https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6
generic_textual HIGH https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6
ssvc Track* https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-hffm-xvc3-vprc
cvssv3.1 9.8 https://github.com/steveukx/git-js
cvssv4 8.2 https://github.com/steveukx/git-js
generic_textual HIGH https://github.com/steveukx/git-js
cvssv3.1 9.8 https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8
cvssv3.1 9.8 https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8
cvssv4 8.2 https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8
cvssv4 9.2 https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8
generic_textual HIGH https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8
ssvc Track* https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2026-6951
cvssv4 8.2 https://nvd.nist.gov/vuln/detail/CVE-2026-6951
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-6951
cvssv3.1 9.8 https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078
cvssv3.1 9.8 https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078
cvssv4 8.2 https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078
cvssv4 9.2 https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078
generic_textual HIGH https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078
ssvc Track* https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-6951.json
https://api.first.org/data/v1/epss?cve=CVE-2026-6951
https://github.com/steveukx/git-js
https://nvd.nist.gov/vuln/detail/CVE-2026-6951
02d1d97f3410756095b501fda0ac8ca6 https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6
2461750 https://bugzilla.redhat.com/show_bug.cgi?id=2461750
89a2294febed5dfe737c4c735d936bb6018746a8 https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8
GHSA-hffm-xvc3-vprc https://github.com/advisories/GHSA-hffm-xvc3-vprc
SNYK-JS-SIMPLEGIT-15456078 https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-6951.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-04-25T10:50:10Z/ Found at https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/steveukx/git-js
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/steveukx/git-js
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-04-25T10:50:10Z/ Found at https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-6951
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://nvd.nist.gov/vuln/detail/CVE-2026-6951
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-04-25T10:50:10Z/ Found at https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078
Exploit Prediction Scoring System (EPSS)
Percentile 0.43976
EPSS Score 0.00213
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:47:35.063559+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/6xxx/CVE-2026-6951.json 38.6.0