CVE-2026-6951
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.88%
- CWE
- CWE-94
- Published
- 2026-04-25
- Last modified
- 2026-09-14
Affected products
- n/a simple-git
- n/a org.webjars.npm:simple-git
Weakness type
Related vulnerabilities
- CVE-2026-60004 — Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- CVE-2026-76605 — Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2
- CVE-2026-76604 — Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2
- CVE-2026-92937 — vm2 3.11.6 Remote Code Execution via Promise call/apply
- CVE-2026-85978 — Unauthenticated Remote Code Execution in Akana API Platform
- CVE-2026-62104 — WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability
- CVE-2026-53710 — MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
- CVE-2026-55565 — Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)