CVE-2026-102826: simple-git Command Execution Vulnerability via Unblocked Git Configuration Includes
Summary
CVE-2026-102826: simple-git allows command execution through unblocked Git configuration includes. Affects simple-git versions < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
simple-git is a popular Node.js library that provides an interface for executing Git commands in a simple and efficient manner. It is widely used in CI/CD systems, GitHub Actions, and various development tools to automate Git operations. However, a critical vulnerability has been identified in version 3.36.0, which allows attackers to execute arbitrary commands through unblocked Git configuration includes.
Vulnerability Detail
The vulnerability arises from an OS command injection flaw in the git.clone() function. It allows any application that passes attacker-influenced data into the customArgs parameter to execute arbitrary code. The issue is due to the absence of an entry for 'include.path' in the denylist of the blockUnsafeOperationsPlugin. By using the '-c include.path=<file>' argument, an attacker can load a malicious local file as a git configuration, which can then set the core.sshCommand to execute arbitrary commands during the next remote operation. This vulnerability can lead to pre-authentication remote code execution (RCE) in systems that flow untrusted data into customArgs.
How To Fix
Latest published version: 4.0.2 as of 23 Oct 2026
npm install simple-git@4.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.0
This is the first release that contains the fix.
npm install simple-git@4.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the '-c' or '--config' options in the customArgs parameter. Instead, utilize the typed config option provided by simple-git, which is safer and does not allow arbitrary command execution.
Conclusion
The simple-git package has a critical vulnerability (CVE-2026-102826) that allows for command execution through unblocked Git configuration includes. It is essential to update to version 4.0.0 or later to mitigate this risk. Users should also be cautious about passing untrusted data into the customArgs parameter.
See every vulnerability recorded for simple-git →
FAQ
CVE-2026-102826 is a vulnerability in the simple-git package that allows for OS command injection through unblocked Git configuration includes.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
The vulnerability can lead to pre-authentication remote code execution, allowing attackers to execute arbitrary commands on the server running the vulnerable application.
If immediate updates are not possible, refrain from using the '-c' or '--config' options in customArgs and consider implementing input validation to prevent untrusted data from being passed.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for simple-git.
