simple-git unsafe-operation guard does not block trailer command configuration
## Affected product The default `blockUnsafeOperationsPlugin` in `simple-git` when an application permits untrusted values to reach `SimpleGitOptions.config` or Git inline configuration arguments such as `-c =`. ## Summary `trailer..cmd` is not recognized as unsafe by the default guard. Therefore, a configured inline value reaches Git without a `GitPluginError`. Git documents `trailer..cmd` as a shell command invoked by `git interpret-trailers`. An application that relies on the default plugin to reject unsafe configuration can therefore execute a command supplied through an untrusted trailer-command configuration value. ## Technical details `simple-git/src/lib/git-factory.ts` installs `commandConfigPrefixingPlugin` before `blockUnsafeOperationsPlugin`. The prefixing plugin in `simple-git/src/lib/plugins/command-config-prefixing-plugin.ts` turns every `SimpleGitOptions.config` entry into `-c =` before the unsafe-operation plugin evaluates the final argv. In `simple-git@3.36.0`, `blockUnsafeOperationsPlugin` delegates to `@simple-git/argv-parser`. `packages/argv-parser/src/vulnerabilities/detect-vulnerable-config-writes.ts` compares parsed configuration writes against `preventUnsafeConfig`. That list has no matcher for `trailer..cmd`, so the invocation is allowed. Git v2.39.5's `Documentation/git-interpret-trailers.txt` states that `trailer..cmd` specifies a shell command called to generate or modify a trailer. ## Preconditions The application must use an affected `simple-git`
GHSA-x6jw-m9v5-85vh
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-x6jw-m9v5-85vh
simple-git
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 4.0.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "3.15.0"
},
{
"fixed": "4.0.1"
}
]
}
],
"package": {
"name": "simple-git",
"purl": "pkg:npm/simple-git",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-x6jw-m9v5-85vh/GHSA-x6jw-m9v5-85vh.json"
}
}
]- Related CVEs
- CVE-2026-102828
Source reference:
/aliases
Publisher severity
critical
Source reference: /database_specific/severity
- Event
- #85964 · Revision 1
- Added to Heist Feed
- Publisher date