GHSA-hffm-xvc3-vprc
Critical · 9.8CVSS
9.8
EPSS
—
Published
Apr 25, 2026
CISA due date
—
The record
simple-git is vulnerable to Remote Code Execution
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | simple-git | 0 | 3.36.0 |
Related vulnerabilities
- CVE-2026-6951 Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution… Same vulnerability
- CVE-2026-28291 simple-git enables running native Git commands from JavaScript. Also affects simple-git
- GHSA-jcxm-m3jx-f287 simple-git Affected by Command Execution via Option-Parsing Bypass Also affects simple-git
- CVE-2026-28292 `simple-git`, an interface for running git commands in any node.js application, has an… Also affects simple-git
- GHSA-r275-fr43-pm7q simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow… Also affects simple-git
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-94
- CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-94