CVE-2026-102827: Simple-git command injection (CVSS 8.1)

Description

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Simple-git< 4.0.0

Remediation

Fixed in

Simple-git≥ 4.0.0

Patch & vendor advisories

References

https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7Patch
https://github.com/steveukx/git-js/pull/1193Patch
https://github.com/steveukx/git-js/releases/tag/[email protected]Release Notes
https://github.com/steveukx/git-js/security/advisories/GHSA-858h-whjf-mvg5ExploitMitigationVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-102827 being actively exploited?

CVE-2026-102827 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.40%.

How severe is CVE-2026-102827?

CVE-2026-102827 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 0.40% probability of exploitation.

Which products are affected by CVE-2026-102827?

Affected products include Simple-git.

How do I fix CVE-2026-102827?

Upgrade affected software to a fixed version, for example Simple-git 4.0.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-102827 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo