Skip to content
Heist/ feed
HighFix available

simple-git allows command execution through unblocked Git configuration includes

Type: advisorySource: OSV1 source record

## Summary An OS command injection vulnerability in `git.clone()` allows any application that flows attacker-influenced data into `customArgs` to execute arbitrary code. simple-git 3.36.0 (current latest on npm) ships without any `include.path` entry in the `blockUnsafeOperationsPlugin` denylist. Passing `-c include.path=` via customArgs loads any local file as a gitconfig. The loaded file can set `core.sshCommand` (or any otherwise-denied key), and the next remote operation in the same clone executes the attacker's command. PR #1167 (merged to main 2026-05-10, not yet released to npm) adds `preventConfigBuilder('include.path', 'allowUnsafeInclude')` to the denylist. The generated regex `/\s*include.path/` closes the plain spelling but does not match the conditional form `includeIf..path`. The variant therefore survives the upcoming release if the regex is not tightened in the same cycle. This sits in the same denylist class as the prior incomplete-fix chain (CVE-2022-24433, CVE-2022-24066, CVE-2022-25912, CVE-2022-25860, CVE-2026-28291, CVE-2026-28292). `include` and `includeIf` are not referenced in any published advisory, in any commit prior to PR #1167, or anywhere in the 3.36.0 source. ## Details Two sinks share the same root cause: the denylist is incomplete. ### Sink A: published 3.36.0 has no `include.path` entry `packages/argv-parser/src/vulnerabilities/detect-vulnerable-config-writes.ts` in the v3.36.0 tag contains no entry for `include.path` or `includeIf.*.path`.

Announced Source revision 1
Original source ↗

GHSA-g4wm-2vf7-vfgr

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-g4wm-2vf7-vfgr

simple-git

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
4.0.0

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.0.0"
          }
        ]
      }
    ],
    "package": {
      "name": "simple-git",
      "purl": "pkg:npm/simple-git",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-g4wm-2vf7-vfgr/GHSA-g4wm-2vf7-vfgr.json",
      "last_known_affected_version_range": "<= 3.36.0"
    }
  }
]
Related CVEs
CVE-2026-102826

Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-102826 · High

git-js

Event
#85962 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement