GHSA-r275-fr43-pm7q
Critical · 9.8CVSS
9.8
EPSS
—
Published
Mar 10, 2026
CISA due date
—
The record
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | simple-git | 3.15.0 | 3.32.3 |
Related vulnerabilities
- CVE-2026-28292 `simple-git`, an interface for running git commands in any node.js application, has an… Same vulnerability
- GHSA-hffm-xvc3-vprc simple-git is vulnerable to Remote Code Execution Also affects simple-git
- CVE-2026-6951 Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution… Also affects simple-git
- CVE-2026-28291 simple-git enables running native Git commands from JavaScript. Also affects simple-git
- GHSA-jcxm-m3jx-f287 simple-git Affected by Command Execution via Option-Parsing Bypass Also affects simple-git
- CVE-2026-86472 fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. CWE-178
- CVE-2026-87876 Two case-insensitive comparisons on request-derived usernames outside the main… CWE-178
- CVE-2026-84428 fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names… CWE-178