Back
CVE-2026-28292
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE
Critical9.8EPSS 1.4%
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| redhat-SADPADP (enrichment) | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.4% · top 27% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs
- CWE-178: Improper Handling of Case Sensitivity (opens in a new tab)All about CWE-178 and its CVEs
- CWE-76: Improper Neutralization of Equivalent Special Elements (opens in a new tab)All about CWE-76 and its CVEs
Affected products
- affected >= 3.15.0, < 3.32.3
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- npmsimple-gitGHSA-r275-fr43-pm7q (opens in a new tab)
References (7)
- https://github.com/steveukx/git-js/security/advisories/GHSA-r275-fr43-pm7q (opens in a new tab)x_refsource_CONFIRM
- https://github.com/steveukx/git-js/commit/f7042088aa2dac59e3c49a84d7a2f4b26048a257 (opens in a new tab)x_refsource_MISC
- https://www.codeant.ai/security-research/security-research-simple-git-remote-code-execution-cve-2026-28292 (opens in a new tab)x_refsource_MISC
- https://www.codeant.ai/security-research/simple-git-remote-code-execution-cve-2026-28292 (opens in a new tab)exploit
- https://access.redhat.com/security/cve/CVE-2026-28292 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2446162 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28292.json (opens in a new tab)x_sadp-csaf-vex
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-r275-fr43-pm7q (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-28292)Record last updated .