CVE-2026-102827: simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
simple-gitto a version that resolves this vulnerability.Fixed in 4.0.0
Event History
Frequently Asked Questions
Which applications are realistically exposed to command execution?
Applications using simple-git before 4.0.0 are exposed when they pass attacker-influenced arguments to Git push operations. The vulnerable path involves pushes to a local or file remote, or an attacker-influenced receive-pack target.
Does an attacker need authentication or user interaction?
No privileges or user interaction are required according to the supplied vector. Exploitation has high attack complexity because the attacker must be able to influence relevant push arguments in a consuming application.
Are default simple-git protections sufficient?
No. Before 4.0.0, the default blockUnsafeOperationsPlugin checks literal option names, but Git accepts unambiguous abbreviated long options such as --receive-p or --exe, allowing dangerous push options to bypass detection.
What is the remediation?
Upgrade simple-git to version 4.0.0, which fixes the issue. If upgrading cannot happen immediately, do not allow untrusted input to control Git push arguments, especially receive-pack or exec-related options and their abbreviations.