CVE-2026-6951: Remote Code Execution Vulnerability in simple-git
Summary
CVE-2026-6951: simple-git is vulnerable to Remote Code Execution. Affects simple-git versions < 3.36.0. Fixed in 3.36.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
simple-git is a popular Node.js package that provides a simple interface for executing Git commands in a programmatic way. It is widely used in various applications to automate Git operations, making it essential for developers who need to integrate Git functionalities into their workflows. However, certain versions of simple-git are vulnerable to a Remote Code Execution (RCE) issue, which can have severe implications if exploited.
Vulnerability Detail
The vulnerability arises from an incomplete fix for CVE-2022-25912, which initially aimed to block the '-c' option in simple-git. However, the equivalent '--config' form was not adequately addressed, allowing attackers to pass untrusted input to the options argument. By enabling 'protocol.ext.allow=always' and using an 'ext::' clone source, an attacker can execute arbitrary code on the host system. This vulnerability poses a significant risk, as it can lead to unauthorized access and control over the affected systems.
How To Fix
Latest published version: 4.0.2 as of 23 Oct 2026
npm install simple-git@4.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.36.0
This is the first release that contains the fix.
npm install simple-git@3.36.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the '--config' option with untrusted input until you can update to the patched version. Additionally, ensure that your application does not allow untrusted sources to influence the options passed to simple-git.
Conclusion
The CVE-2026-6951 vulnerability in simple-git poses a significant risk of Remote Code Execution. It is crucial for developers using this package to update to version 3.36.0 or later to mitigate the risks associated with this vulnerability. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for simple-git →
FAQ
CVE-2026-6951 is a vulnerability in the simple-git package that allows for Remote Code Execution due to an incomplete fix for a previous vulnerability.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring any installation.
The risks include unauthorized access to your system, potential data breaches, and the ability for attackers to execute arbitrary code.
Yes, updating to version 3.36.0 or later of the simple-git package will patch the vulnerability.
If you cannot update immediately, avoid using the '--config' option with untrusted input and ensure that your application is not exposed to untrusted sources.
Related vulnerabilities
Recent vulnerabilities recorded for simple-git.
