simple-git allows command execution through unblocked Git configuration includes
## Summary An OS command injection vulnerability in `git.clone()` allows any application that flows attacker-influenced data into `customArgs` to execute arbitrary code. simple-git 3.36.0 (current latest on npm) ships without any `include.path` entry in the `blockUnsafeOperationsPlugin` denylist. Passing `-c include.path=` via customArgs loads any local file as a gitconfig. The loaded file can set `core.sshCommand` (or any otherwise-denied key), and the next remote operation in the same clone executes the attacker's command. PR #1167 (merged to main 2026-05-10, not yet released to npm) adds `preventConfigBuilder('include.path', 'allowUnsafeInclude')` to the denylist. The generated regex `/\s*include.path/` closes the plain spelling but does not match the conditional form `includeIf..path`. The variant therefore survives the upcoming release if the regex is not tightened in the same cycle. This sits in the same denylist class as the prior incomplete-fix chain (CVE-2022-24433, CVE-2022-24066, CVE-2022-25912, CVE-2022-25860, CVE-2026-28291, CVE-2026-28292). `include` and `includeIf` are not referenced in any published advisory, in any commit prior to PR #1167, or anywhere in the 3.36.0 source. ## Details Two sinks share the same root cause: the denylist is incomplete. ### Sink A: published 3.36.0 has no `include.path` entry `packages/argv-parser/src/vulnerabilities/detect-vulnerable-config-writes.ts` in the v3.36.0 tag contains no entry for `include.path` or `includeIf.*.path`.
GHSA-g4wm-2vf7-vfgr
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-g4wm-2vf7-vfgr
simple-git
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 4.0.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.0"
}
]
}
],
"package": {
"name": "simple-git",
"purl": "pkg:npm/simple-git",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-g4wm-2vf7-vfgr/GHSA-g4wm-2vf7-vfgr.json",
"last_known_affected_version_range": "<= 3.36.0"
}
}
]- Related CVEs
- CVE-2026-102826
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #85962 · Revision 1
- Added to Heist Feed
- Publisher date