SB2026041460 - OS Command Injection in Simple Git

Description

This security bulletin contains information about 1 security vulnerability.

1) OS Command Injection (CVE-ID: CVE-2026-28291)

The vulnerability allows a remote attacker to execute arbitrary commands.

The vulnerability exists due to improper neutralization of special elements used in an os command in the option-parsing logic of simple-git when processing user-controlled git command options. A remote attacker can supply specially crafted option variants to execute arbitrary commands.

The issue can be triggered even when allowUnsafePack is explicitly set to false, and the provided proof of concept succeeded on Linux-based environments but was not reproduced on Windows 11.

Remediation

Install update from vendor's website.

References

• https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287
• https://github.com/advisories/GHSA-jcxm-m3jx-f287