simple-git CVE-2026-102828

Exploitation requires that the host application pass ATTACKER-CONTROLLED values into simple-git's SimpleGitOptions.config or into inline -c arguments, AND that the application subsequently trigger a code path invoking git interpret-trailers. The specific unsafe setting is trailer.<token>.cmd (also trailer.<token>.command), which the default blockUnsafeOperationsPlugin failed to classify as unsafe in versions 3.15.0 through 4.0.0. Limiting factors: applications that only pass trusted/hard-coded configuration are NOT exploitable; the flaw does not bypass simple-git's other unsafe-operation blocks; and the resulting command runs only with the privileges of the Node.js process (no privilege escalation). The related rebase --exec/-x vector fixed in the same commit has similar preconditions. Applications on 4.0.1+ are protected by default (the new allowUnsafeCommandBinaries category must be explicitly opted into).

This is a genuine remote code execution flaw (CWE-78) in simple-git, one of the most heavily depended-upon Git wrappers in the Node.js ecosystem, so the product footprint alone warrants attention. The vendor CVSS 4.0 score of 9.2 is driven by full VC:H/VI:H/VA:H impact (arbitrary command execution as the Node process) combined with AV:N/PR:N/UI:N, but it is tempered by AC:H and AT:P - reflecting that exploitation is not universal: the application must route attacker-controlled data into SimpleGitOptions.config or inline -c arguments. The real-world risk therefore hinges on application design, not on simple-git being installed. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the severity is potential/structural rather than observed. A notable nuance: the vulnerability is specifically a GAP in a security control - the default blockUnsafeOperationsPlugin was SUPPOSED to block this class of RCE but failed to classify trailer.<token>.cmd/.command, so developers who believed they were protected were not. Net assessment: a high-priority patch for anyone forwarding untrusted input into git config, but a low-to-moderate practical concern for the (likely majority of) integrations that only pass trusted, hard-coded configuration.

A Node.js web service uses simple-git and lets users influence git configuration - for example a CI/hosting platform that accepts per-repo config or trailer settings - and forwards that value into SimpleGitOptions.config or an inline -c argument. An attacker submits a value that sets trailer.<token>.cmd (or .command) to a shell command; when the application later runs git interpret-trailers, Git invokes the attacker's command with the identity and permissions of the Node.js process. No public PoC was provided, and the AC:H/AT:P vector means the vulnerable data flow must already exist in the application.