GHSA-jcxm-m3jx-f287
High · 8.1CVSS
8.1
EPSS
—
Published
Apr 13, 2026
CISA due date
—
The record
simple-git Affected by Command Execution via Option-Parsing Bypass
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | simple-git | 0 | 3.32.0 |
Related vulnerabilities
- CVE-2026-28291 simple-git enables running native Git commands from JavaScript. Same vulnerability
- GHSA-hffm-xvc3-vprc simple-git is vulnerable to Remote Code Execution Also affects simple-git
- CVE-2026-6951 Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution… Also affects simple-git
- CVE-2026-28292 `simple-git`, an interface for running git commands in any node.js application, has an… Also affects simple-git
- GHSA-r275-fr43-pm7q simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow… Also affects simple-git
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78