CVE-2026-102826: Simple-git command injection (CVSS 8.1)

Description

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Simple-git< 4.0.0

Remediation

Fixed in

Simple-git≥ 4.0.0

Patch & vendor advisories

References

https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7Patch
https://github.com/steveukx/git-js/pull/1193Patch
https://github.com/steveukx/git-js/releases/tag/[email protected]Release Notes
https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgrExploitMitigationVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-102826 being actively exploited?

CVE-2026-102826 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.46%.

How severe is CVE-2026-102826?

CVE-2026-102826 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 0.46% probability of exploitation.

Which products are affected by CVE-2026-102826?

Affected products include Simple-git.

How do I fix CVE-2026-102826?

Upgrade affected software to a fixed version, for example Simple-git 4.0.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-102826 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo