CVE-2026-28292CWE-178CWE-78

simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE

Critical · published March 10, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
71.2
In the wild
Unconfirmed
What it is

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01345 · 71.2th percentile
Weaknesses
CWE-178 · Improper Handling of Case Sensitivity; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-10T18:34Z
EPSS history
Timeline
  • 10 MAR 18:34Z
    simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE
    cvelistv5