CVE-2026-28292

What it actually does

simple-git (npm) versions 3.15.0 through 3.32.2 insufficiently sanitizes attacker-influenced values that are turned into git command-line arguments. The gap bypasses the argument and protocol restrictions added for CVE-2022-25860 and CVE-2022-25912, so a crafted clone/fetch/remote/path value can inject extra git options or an unsafe transport and cause the Node.js process to execute arbitrary OS commands as the application user (full RCE: confidentiality, integrity, and availability of the host).

Why it matters to the business

Any Node.js service, CLI, or CI job that uses simple-git and accepts untrusted git-related input (clone URLs, remotes, branches, paths) can be fully taken over: source and secrets stolen, pipelines poisoned, and production hosts used as a foothold. The issue is network-reachable, needs no privileges or user interaction (CVSS 9.8), and simple-git is a common transitive dependency, so blast radius is large even if your app never calls git directly. It is not in CISA KEV, has no public exploit maturity, and EPSS is low and flat (~0.013 over 30 days), so mass exploitation is not currently indicated—but the technical severity and 202 days since publication still justify treating unpatched runtimes as a high operational risk.

How an attack unfolds

An attacker finds a Node.js application that depends on a vulnerable simple-git release and that passes attacker-controlled data into git operations (for example clone, fetch, pull, or remote add). They submit a specially crafted repository URL or argument that slips past the post-2022 allow-lists (unsafe config flags, alternative transports, or option-injection patterns the earlier patches did not fully block). simple-git then spawns the system git binary with those extra arguments. Git interprets the injected options and runs attacker-chosen commands on the host under the application account, giving a shell or implant without authenticating to the app itself. No named threat groups or ransomware campaigns are associated with this CVE at this time.

How to fix it

Upgrade simple-git past the affected range 3.15.0–3.32.2 to a release the maintainer marks as fixed (the advisory mentions an attempted fix in 3.23.0, but that version still sits inside the affected range—do not treat 3.23.x as sufficient). Pin and lock the upgraded version in package-lock.json / yarn.lock / pnpm-lock.yaml and rebuild all images and CI agents. Until you can upgrade: do not pass untrusted URLs, refs, or paths into simple-git; allow-list known remotes and refs; disable unused git transports; run the Node process with least privilege and no unnecessary secrets; and use SCA to fail builds that still pull 3.15.0–3.32.2, including transitive copies.

How to confirm the fix worked

Inventory every direct and transitive simple-git version with npm ls simple-git (and equivalents for yarn/pnpm) and by searching lockfiles and container SBOM for "simple-git" in the 3.15.0–3.32.2 range. Confirm deployed artifacts and CI images were rebuilt after the bump. Regression-test git clone/fetch/pull paths with untrusted-looking URLs and extra option-like strings and verify they are rejected rather than passed to git. SCA/CVE scanners should report the image or repo as clear of CVE-2026-28292 only after the lockfile and runtime node_modules match a non-affected release.

Typical attack path

1. Discover a Node.js application or CI job that uses simple-git 3.15.0–3.32.2 and feeds user- or webhook-controlled values into clone, fetch, pull, checkout, or remote operations.
2. Supply a crafted git URL, remote, ref, or path that bypasses simple-git’s existing argument and protocol filters (the incomplete CVE-2022-25860 / CVE-2022-25912 mitigations).
3. Trigger the application path that invokes simple-git so the library execs the git binary with the injected arguments.
4. Injected git options or an unsafe transport cause arbitrary command execution in the application’s user context.
5. Use the resulting host access to steal credentials and source, persist, or move laterally; no public exploit kit is reported, so this is typically a targeted or opportunistic web/CI input rather than a commodity worm.

How to detect it

There is no public exploit and no named actor, so look for the preconditions and for git being spawned in unusual ways rather than a single signature. Review application, reverse-proxy, and CI logs around clone/fetch/pull/webhook endpoints for unexpected repository URLs or arguments containing extra dashes, git config flags, or alternate transports. On hosts, inspect process telemetry (EDR, auditd, Sysmon) for node or npm spawning git with unusual argv (extra -c, --upload-pack, --exec-path, GIT_SSH_COMMAND, ext::, and similar). Check package-lock.json, yarn.lock, pnpm-lock.yaml, node_modules/simple-git/package.json, and container SBOMs for versions 3.15.0–3.32.2 as evidence of exposure. After suspected abuse, look for new users, unexpected outbound git or shell children of node, and modified git config or hooks in working copies the app uses.

• simple-git@3.1
• simple-git@3.2
• simple-git@3.3
• "simple-git": "3.1
• "simple-git": "3.2
• "simple-git": "3.3
• node_modules/simple-git/package.json
• --upload-pack
• core.sshCommand
• GIT_SSH_COMMAND
• ext::
• --exec-path=
• git -c
• comm=git

What your security team should do

• Treat this as a critical command-injection RCE on every Node.js workload that can reach git via simple-git; patch even though KEV is false and EPSS is low.
• Force an upgrade of simple-git beyond 3.32.2 in application repos, base images, and CI runners; do not rely on the incomplete 3.23.0 fix.
• Block or fail CI on lockfiles that still resolve simple-git 3.15.0–3.32.2 (including transitive dependencies).
• Stop accepting untrusted clone URLs, remotes, and refs in any API, webhook, or bot that shells out through simple-git.
• Hunt historical process and CI logs for node-spawned git with injected options (see detection_guidance) given the CVE has been public for ~202 days.
• Reduce blast radius: non-root Node users, no long-lived cloud keys in the git-using process, and network egress controls on git transports.