CVE-2026-28292: simple-git Case-Insensitive Protocol Bypass Leading to RCE
Summary
CVE-2026-28292: The blockUnsafeOperationsPlugin in simple-git fails to block git protocol override arguments when the config key is passed in uppercase or mixed case. Affects simple-git versions >= 3.15.0, < 3.32.3. Fixed in 3.32.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
simple-git is a popular Node.js package that provides a simple interface for executing Git commands. It is widely used in applications that require Git functionalities, such as cloning repositories, fetching updates, and pushing changes. The package includes a plugin designed to block unsafe operations, but it has a critical vulnerability that allows attackers to bypass these protections under certain conditions.
Vulnerability Detail
The vulnerability arises from the blockUnsafeOperationsPlugin in simple-git, which fails to properly validate the case of the 'protocol.allow' configuration key. Git treats configuration keys as case-insensitive, meaning that an attacker can exploit this by passing the key in uppercase or mixed-case formats (e.g., 'PROTOCOL.ALLOW=always'). This allows the attacker to enable the 'ext::' protocol, which can execute arbitrary OS commands on the host machine. The regex used for validation is case-sensitive, leading to a bypass of the intended security measures. The potential ramifications include unauthorized command execution, which could compromise the integrity and security of the host system.
How To Fix
Latest published version: 4.0.2 as of 23 Oct 2026
npm install simple-git@4.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.32.3
This is the first release that contains the fix.
npm install simple-git@3.32.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing user-controlled values into the 'customArgs' parameter of simple-git methods such as clone, fetch, pull, or push. Ensure that any configuration keys are passed in lowercase to prevent exploitation until the package can be updated.
Conclusion
The CVE-2026-28292 vulnerability in simple-git poses a significant risk due to its potential for arbitrary command execution. It is crucial for developers using this package to update to the patched version and implement best practices to secure their applications against exploitation.
See every vulnerability recorded for simple-git →
FAQ
CVE-2026-28292 is a critical vulnerability in the simple-git package that allows attackers to bypass security checks and execute arbitrary commands on the host machine.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities without requiring any signup.
The CVSS score of this vulnerability is 9.8, indicating a critical level of risk associated with potential exploitation.
Update the simple-git package to version 3.32.3 or later to mitigate the vulnerability. Additionally, avoid passing user-controlled arguments to Git commands until the update is applied.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the package-lock.json file, helping you maintain security without needing direct access to the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for simple-git.
