CVE-2026-28292
`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 1.30%
- CWE
- CWE-78, CWE-178
- Published
- 2026-03-10
- Last modified
- 2026-07-15
Affected products
- steveukx simple-git
Weakness type
Related vulnerabilities
- CVE-2026-73694 — FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition
- CVE-2026-73693 — FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler
- CVE-2026-65639 — OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a...
- CVE-2026-65638 — Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated...
- CVE-2026-81468 — Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special...
- CVE-2026-81467 — Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special...
- CVE-2026-64837 — ICEcoder through 8.1 OS Command Injection via lib/properties.php
- CVE-2026-88889 — Renovate before 44.14.7 Command Injection via distributionType