CVE-2026-28291: simple-git RCE Vulnerability

CVE-2026-28291 Overview

CVE-2026-28291 is a command injection vulnerability in simple-git, a popular JavaScript library that enables running native Git commands from JavaScript applications. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack.

The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior.

Critical Impact

Attackers can bypass security controls and execute arbitrary commands on systems using vulnerable simple-git versions, potentially leading to complete system compromise through command injection.

Affected Products

• simple-git versions up to and including 3.31.1
• Applications using simple-git for Git operations in Node.js environments
• CI/CD pipelines and automation tools leveraging simple-git

Discovery Timeline

• April 13, 2026 - CVE-2026-28291 published to NVD
• April 14, 2026 - Last updated in NVD database

Technical Details for CVE-2026-28291

Vulnerability Analysis

This vulnerability is classified as CWE-78 (OS Command Injection), where user-controlled input is passed to Git commands without adequate sanitization. The simple-git library includes a block-unsafe-operations-plugin.ts that attempts to prevent dangerous Git options from being executed. However, the regular expression-based blocklist approach fails to account for Git's highly flexible option parsing.

Git allows combining multiple single-character options into a single argument. For example, instead of passing -u directly (which would be blocked), an attacker can pass -vu, -4u, -nu, or countless other combinations that include the dangerous u flag alongside other legitimate options. The blocklist pattern cannot feasibly enumerate all possible combinations that could smuggle in unsafe operations.

This vulnerability represents a bypass of the previous security fix for CVE-2022-25860, highlighting the fundamental weakness of blocklist-based security approaches when dealing with complex command parsers.

Root Cause

The root cause is the use of a regular expression-based blocklist to filter dangerous Git options, which cannot comprehensively account for Git's flexible option parsing behavior. Git accepts a virtually infinite number of valid option variants through combined flags, making complete blocklist coverage infeasible. The original fix for CVE-2022-25860 blocked explicit dangerous options like -u and --upload-pack, but failed to consider that these could be embedded within combined option strings.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker who can influence Git command arguments passed to simple-git (such as through a web application that allows repository cloning) can inject malicious options that bypass the safety plugin. By crafting option strings that include dangerous flags combined with benign flags (e.g., -vu instead of -u), attackers can execute arbitrary commands on the target system.

The fix in version 3.32.0 introduces a more robust detection mechanism for clone-specific options:

import { GitPluginError } from '../errors/git-plugin-error';
import type { SimpleGitPluginConfig } from '../types';

+const CLONE_OPTIONS = /^\0*(-|--|--no-)[\0\dlsqvnobucj]+/;
+
function isConfigSwitch(arg: string | unknown) {
   return typeof arg === 'string' && arg.trim().toLowerCase() === '-c';
}

+function isCloneSwitch(char: string, arg: string | unknown) {
+   return Boolean(typeof arg === 'string' && CLONE_OPTIONS.test(arg) && arg.includes(char));
+}

function preventProtocolOverride(arg: string, next: string) {
   if (!isConfigSwitch(arg)) {
      return;

Source: GitHub Commit

Detection Methods for CVE-2026-28291

Indicators of Compromise

• Unusual Git clone operations with combined flag arguments containing -u character sequences
• Application logs showing Git commands with suspicious option combinations like -vu, -4u, -nu
• Unexpected process spawning from Node.js applications that use simple-git
• Network connections to unexpected remote hosts initiated by Git processes

Detection Strategies

• Monitor Node.js application dependencies for simple-git versions prior to 3.32.0 using npm audit or similar dependency scanning tools
• Implement runtime application monitoring to detect anomalous Git command execution patterns
• Review application logs for Git command invocations with unusual option strings containing multiple flags
• Deploy software composition analysis (SCA) tools to identify vulnerable simple-git versions across your environment

Monitoring Recommendations

• Enable verbose logging for applications using simple-git to capture all Git command arguments
• Configure alerting for Git clone operations with unusual option combinations in production environments
• Implement process monitoring to detect child processes spawned by Node.js applications performing Git operations
• Establish baseline behavior for Git operations and alert on deviations that may indicate exploitation attempts

How to Mitigate CVE-2026-28291

Immediate Actions Required

• Upgrade simple-git to version 3.32.0 or later immediately across all affected applications
• Audit applications that accept user input for Git operations and implement additional input validation
• Review recent Git operations in logs for signs of exploitation attempts using combined option flags
• Consider temporarily disabling user-controlled Git clone functionality until patches are applied

Patch Information

The vulnerability has been addressed in simple-git version 3.32.0. The fix introduces an improved isCloneSwitch function that can detect dangerous flags even when combined with other options. Organizations should update their package.json dependencies and run npm update or equivalent commands to apply the fix.

For more details, see the GitHub Security Advisory and the release notes for version 3.32.0.

Workarounds

• If immediate upgrade is not possible, implement application-level input validation to reject any Git arguments containing the u character in option flags
• Restrict the Git operations exposed to user input, limiting functionality to safe read-only operations where feasible
• Run simple-git operations in sandboxed environments with limited system access to reduce potential impact
• Consider implementing allowlist-based validation for Git command arguments rather than relying solely on the library's built-in blocklist

# Update simple-git to the patched version
npm update simple-git@3.32.0

# Verify installed version
npm list simple-git

# Audit dependencies for known vulnerabilities
npm audit