Sign in
Deutsch English Español Polski
High

Command injection in simple-git

  • Disclosed: 12.03.2022
  • Updated: 11.10.2026 10:22

The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it was possible to get arbitrary command execution.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package simple-git < 3.3.0 3.3.0

References

CVSS score 8.1/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-74, CWE-77
Platform
npm
Package
simple-git
Disclosed
12.03.2022
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-3f95-r44v-8mrg - CC BY 4.0

Vulnerability history: simple-git

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (10) in the archive
Total entries
10
First → latest
03.2022 10.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 3
  • High 7

Disclosures per year

Severity:
  1. simple-git unsafe-operation guard does not block trailer command configuration
    Critical CVE-2026-102828 >= 3.15.0, < 4.0.1 4.0.1
  2. simple-git allows command execution through unblocked Git configuration includes
    High · 8.1 CVE-2026-102826 < 4.0.0 4.0.0
  3. simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
    High · 8.1 CVE-2026-102827 < 4.0.0 4.0.0
  4. simple-git is vulnerable to Remote Code Execution
    High · 9.8 CVE-2026-6951 < 3.36.0 3.36.0
  5. simple-git Affected by Command Execution via Option-Parsing Bypass
    High · 8.1 CVE-2026-28291 < 3.32.0 3.32.0
  6. simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
    Critical · 9.8 CVE-2026-28292 >= 3.15.0, < 3.32.3 3.32.3
  7. simple-git < 3.16.0 - Remote Code Execution
    High · 8.1 CVE-2022-25860 < 3.16.0 3.16.0
  8. simple-git < 3.15.0 - Remote Code Execution
    Critical · 9.8 CVE-2022-25912 < 3.15.0 3.15.0
  9. Command injection in simple-git
    High · 8.1 CVE-2022-24066 < 3.5.0 3.5.0
  10. Command injection in simple-git this entry
    High · 8.1 CVE-2022-24433 < 3.3.0 3.3.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.