CVE-2026-102826: simple-git allows command execution through unblocked Git configuration includes
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
simple-gitto a version that resolves this vulnerability.Fixed in 4.0.0
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using simple-git before 4.0.0 are exposed only where attacker-influenced values can be passed as customArgs to git.clone() and the Node.js process can read an attacker-controlled Git configuration file.
What does an attacker need to exploit this?
The attacker needs to influence custom arguments supplied to git.clone() and arrange for Git to load a configuration file under their control that is readable by the application process. They can use include.path or a conditional includeIf.<condition>.path to load that file.
What is the impact after a malicious configuration is loaded?
The configuration can set an executable Git option such as core.sshCommand. Git invokes that command during cloning with the privileges of the Node.js process, allowing command execution with high confidentiality, integrity, and availability impact.
What should be done if upgrading is not immediately possible?
Do not pass attacker-influenced customArgs to git.clone(), and prevent the application process from reading attacker-controlled Git configuration files. Pay particular attention to arguments that can introduce include.path or includeIf.<condition>.path configuration includes.
How is the issue fixed?
Upgrade simple-git to version 4.0.0, which fixes the incomplete rejection of configuration includes in custom arguments to git.clone().