PatchTheCVE: simple-git project

CVE-2026-102828: simple-git, an interface for running git commands in any node.js application, enables applications to execute

Thu, 08 Oct 2026 20:03:07 +0000

CRITICAL 9.8: simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes att

CVE-2026-102827: simple-git, an interface for running git commands in any node.js application, enables applications to execute

Thu, 08 Oct 2026 20:11:17 +0000

HIGH 8.1: simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous lon

CVE-2026-102826: simple-git, an interface for running git commands in any node.js application, enables applications to execute

Thu, 08 Oct 2026 20:21:08 +0000

HIGH 8.1: simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The miss

CVE-2026-28291: simple-git enables running native Git commands from JavaScript

Mon, 26 Oct 2026 22:10:00 +0000

HIGH 8.1: simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE