CVE-2026-102829: Critical Security Control Bypass in @simple-git/argv-parser Due to Omission of VISUAL Editor Detection
Summary
CVE-2026-102829: simple-git: VISUAL editor environment variable is omitted from unsafe editor detection. Affects @simple-git/argv-parser versions < 2.0.1. Fixed in 2.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @simple-git/argv-parser package is a utility for parsing command-line arguments in Git operations. It is widely used in applications that automate Git processes, providing a structured way to handle various Git commands and their parameters. This package is essential for developers who rely on Git for version control in their projects. However, it has a critical vulnerability that arises from its failure to classify the VISUAL environment variable as an unsafe editor, potentially allowing malicious code execution during Git operations.
Vulnerability Detail
The vulnerability stems from the omission of the VISUAL environment variable in the unsafe editor detection logic of the @simple-git/argv-parser package. Specifically, the GitEnvKeys mapping only includes editor-related variables like EDITOR, GIT_EDITOR, and GIT_SEQUENCE_EDITOR, while VISUAL is ignored. This oversight allows an attacker to set VISUAL to a malicious executable, which Git may invoke during operations such as 'git commit --amend' or 'git rebase -i'. Consequently, this can lead to arbitrary code execution under the host user's privileges, posing a significant security risk.
How To Fix
Latest published version: 2.0.1 as of 22 Oct 2026
npm install @simple-git/argv-parser@2.0.1The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the VISUAL environment variable is not set or is overridden by a safer editor variable such as EDITOR or GIT_EDITOR. You can unset VISUAL in your shell before running Git commands: unset VISUAL.
Conclusion
The CVE-2026-102829 vulnerability in the @simple-git/argv-parser package poses a significant risk due to the omission of the VISUAL environment variable in unsafe editor detection. It is crucial for developers to update to the patched version and implement the suggested workarounds to mitigate potential exploitation.
See every vulnerability recorded for @simple-git/argv-parser →
FAQ
CVE-2026-102829 is a critical vulnerability in the @simple-git/argv-parser package that allows for a security control bypass due to the omission of the VISUAL editor variable in unsafe editor detection.
If your application forwards attacker-influenced environment variables to Git commands, an attacker could exploit this vulnerability to execute arbitrary code by setting the VISUAL variable to a malicious executable.
Update the @simple-git/argv-parser package to version 2.0.1 or later to ensure that the VISUAL variable is properly classified as unsafe. Additionally, consider unsetting the VISUAL variable in your environment.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score for CVE-2026-102829 is 9.2, indicating a critical level of severity.
