Vulnerabilities CVE-2026-28292

CVE-2026-28292

Critical

Open

TLP:CLEAR

simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.

Details

CVSS Score: 9.8
EPSS Score ⓘ: 1.30%

67.8th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Confidence: 90%
Published: Mar 10, 2026
Last Modified: Jul 15, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.