CVE-2026-28291

What it actually does

The vulnerability is a command injection issue in simple-git versions up to and including 3.31.1. simple-git attempts to prevent dangerous Git options such as -u and --upload-pack, but the protection relies on blocklist-style regular expressions that do not fully match Git's flexible option parsing behavior. Attackers can supply alternate but valid option combinations, such as -vu, -4u, or -nu, that Git interprets in a way that reaches dangerous behavior while bypassing simple-git's safety checks. If untrusted input is passed into simple-git command options, this can allow execution of arbitrary native commands with the privileges of the application process.

Why it matters to the business

Applications that use affected simple-git versions may allow an unauthenticated remote attacker to execute commands on the application server if attacker-controlled input reaches Git options. Successful exploitation can lead to theft of source code or secrets, modification of application data, deployment of malware, service disruption, and broader compromise of connected systems. Although the EPSS score is currently low and the issue is not listed in CISA KEV, the CVSS severity is high because compromise can affect confidentiality, integrity, and availability. The ecosystem risk is meaningful because simple-git is commonly used by JavaScript and Node.js applications that automate repository operations.

How an attack unfolds

An attacker first identifies an application feature that invokes simple-git using user-controllable repository URLs, branch names, refs, clone options, fetch options, or other Git parameters. The attacker then crafts input containing a Git option variant that avoids simple-git's unsafe-operation blocklist while still being parsed by native Git as a dangerous option. Instead of using a directly blocked form such as --upload-pack or -u, the attacker uses an alternate valid option form such as -vu, -4u, or -nu to manipulate Git's execution behavior. When the application passes this input to simple-git, simple-git considers it safe and launches the Git process. Git then interprets the manipulated option and executes attacker-controlled behavior, potentially resulting in arbitrary command execution under the application's operating-system account. The attacker may then establish persistence, read secrets, modify repositories or application files, or pivot to other accessible services.

How to fix it

Upgrade simple-git to version 3.32.0 or later. Because the flaw is caused by incomplete blocklist-based parsing of Git options, do not rely on custom regex blocklists or application-side string filtering as the primary fix. After upgrading, review all code paths that pass user-controlled values into simple-git, especially clone, fetch, pull, checkout, branch, raw, and option-building calls. Avoid passing untrusted input as Git options. Prefer strict allowlists for expected values such as repository hosts, branch names, refs, and paths. Where possible, separate trusted options from untrusted data, reject values beginning with hyphens, and avoid use of raw Git command passthrough for user-supplied data. Run the application with least-privilege operating-system accounts and restrict network egress from processes that invoke Git to reduce post-exploitation impact.

How to confirm the fix worked

Confirm that dependency resolution installs simple-git 3.32.0 or later, including transitive dependency paths. Use package-lock.json, yarn.lock, pnpm-lock.yaml, npm ls simple-git, yarn why simple-git, or pnpm why simple-git to verify the effective version. Review application code for simple-git calls that accept external input into options or raw arguments. Test exposed Git-related functionality with benign option-like inputs beginning with hyphens and confirm they are rejected or treated as data, not options. In CI/CD, add software composition analysis checks that fail builds on simple-git versions 3.31.1 or earlier. If feasible, enable command-line auditing for child processes and confirm that application-triggered Git invocations do not contain suspicious upload-pack or short-option variants derived from user input.

Typical attack path

1. Find a web, API, CI/CD, automation, or backend feature that performs Git operations through simple-git.
2. Determine whether attacker-controlled input is passed into Git command options, repository parameters, refs, branches, or clone/fetch arguments.
3. Craft a malicious Git option that bypasses simple-git's regex-based unsafe option checks, for example by using Git-accepted variants of blocked short options.
4. Submit the malicious input to the exposed application functionality.
5. Trigger the application to invoke simple-git, causing native Git to parse the manipulated option.
6. Execute attacker-controlled commands with the privileges of the application process.
7. Use the resulting access to read secrets, alter files or repositories, disrupt service, or move laterally.

How to detect it

To determine whether exploitation already occurred, review application logs for Git-related features receiving unusual option-like input, especially values beginning with hyphens or containing upload-pack behavior. Examine process creation telemetry such as EDR, auditd, Sysmon for Linux, container runtime logs, Kubernetes audit logs, or cloud workload logs for Git processes launched by Node.js application processes with unusual arguments. Look for native git commands containing --upload-pack, upload-pack, or short option variants such as -vu, -4u, or -nu when those values are not expected in normal application behavior. Investigate cases where a git process spawned shells or command interpreters such as sh, bash, dash, zsh, cmd.exe, or powershell.exe, because ordinary Git operations should not generally result in arbitrary shell execution by application input. Review filesystem artifacts for unexpected files written by the application user, modified repository contents, new startup scripts, unauthorized SSH keys, or downloaded payloads. Check network telemetry for outbound connections from application or Git processes to unapproved hosts immediately after Git operations. If CI/CD or job systems use simple-git, inspect job logs, webhook payloads, and repository operation parameters for suspicious option-like strings. There are no known public exploit-specific indicators provided in the source data, so detection should focus on behavioral evidence of suspicious Git invocation and post-exploitation activity.

• simple-git <= 3.31.1
• simple-git@3.31.1
• simple-git@3.31.0
• --upload-pack
• upload-pack=
• git clone --upload-pack
• git fetch --upload-pack
• git ls-remote --upload-pack
• git clone -u
• git fetch -u
• git ls-remote -u
• git clone -vu
• git fetch -vu
• git ls-remote -vu
• git clone -4u
• git fetch -4u
• git ls-remote -4u
• git clone -nu
• git fetch -nu
• git ls-remote -nu
• node -> git -> sh
• node -> git -> bash
• node -> git -> dash
• node -> git -> zsh
• node -> git -> cmd.exe
• node -> git -> powershell.exe

What your security team should do

• Upgrade all direct and transitive uses of simple-git to 3.32.0 or later as the primary remediation.
• Inventory applications, developer portals, CI/CD services, repository management tools, and automation jobs that invoke Git through Node.js dependencies.
• Prioritize remediation for internet-facing services, services that accept repository URLs or branch/ref input, and systems with access to source code, deployment credentials, or production secrets.
• Search code for simple-git raw command usage and any dynamic construction of Git options from request parameters, webhook payloads, job definitions, or configuration supplied by users.
• Add dependency scanning rules to detect simple-git versions up to and including 3.31.1.
• Implement strict input validation for repository URLs, refs, branch names, and paths; reject unexpected option-like input beginning with hyphens.
• Run Git-invoking services with least privilege and restrict outbound network access to approved repository hosts.
• Review process execution logs for suspicious Git invocations and child processes spawned by application runtimes.
• If suspicious activity is found, rotate credentials accessible to the affected process, including repository tokens, SSH keys, deployment secrets, and cloud credentials.