CVE-2026-102829: simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it as allowUnsafeEditor. A consuming application that forwards attacker-influenced environment values can therefore allow Git to invoke an attacker-selected editor during operations such as commit amendment or interactive rebase when no higher-priority editor setting overrides VISUAL and Git's terminal prerequisites are met. The executable runs with the privileges of the Node.js process. This issue is fixed in argv-parser 2.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
argv-parserto a version that resolves this vulnerability.Fixed in 2.0.1
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using argv-parser before 2.0.1 are exposed only if they forward attacker-influenced environment values into simple-git/Git operations. The affected operation must be one in which Git may launch an editor, such as commit amendment or interactive rebase.
What conditions must be present for exploitation?
An attacker must be able to influence the VISUAL environment variable. No higher-priority Git editor setting can override VISUAL, and Git's terminal prerequisites must be met for it to invoke the selected editor.
What is the impact if exploitation succeeds?
Git can invoke an attacker-selected editor executable. That executable runs with the privileges of the Node.js process.
What should be done if immediate upgrading is not possible?
Do not forward attacker-controlled environment variables to Git operations, and specifically remove or constrain VISUAL. Avoid exposing editor-invoking Git operations to attacker-controlled environment input.
How can I determine whether remediation is needed?
Check whether your application uses argv-parser earlier than 2.0.1 and whether it passes attacker-influenced environment values to simple-git. Review flows that perform commit amendment or interactive rebase and could permit VISUAL to reach Git.