simple-git EUVD-2026-89336

Exploitation requires ALL of: (1) a consuming Node.js application that forwards attacker-influenced environment values into simple-git's environment (e.g., via .env()); (2) the attacker able to set the VISUAL environment variable; (3) NO higher-priority editor setting overriding it (GIT_EDITOR, core.editor, or EDITOR unset/lower priority); (4) a Git operation that actually invokes an editor - commit amendment or interactive rebase; and (5) Git's terminal prerequisites being met. Limiting factors: this is a library flaw, so it is only reachable if the wrapping application unsafely propagates untrusted environment input; the VISUAL variable must not be shadowed by a higher-priority editor setting; and only editor-launching Git subcommands trigger it. These conditions correspond to the vendor's AC:H and AT:P metrics. Affected: simple-git / @simple-git/argv-parser prior to 2.0.1.

This is a real, high-value supply-chain risk but with meaningful preconditions that temper the raw 9.2 score. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) correctly encodes full unauthenticated code execution impact while flagging the difficulty: AC:H and AT:P (attack requirements present) reflect that exploitation is not turnkey - it depends on the CONSUMING application forwarding attacker-influenced environment values into simple-git and performing an editor-invoking Git operation. No EPSS score and no KEV entry were provided, so there is no evidence of active exploitation or a computed exploitation probability. A functional proof-of-concept effectively exists: the fix commit adds an integration test (git-env.spec.ts) that sets VISUAL: 'touch <file>' and runs commit --amend, demonstrating the pre-patch bypass concretely. CWE-78 (OS command injection) plus the vendor GHSA advisory and merged fix (PR #1201, argv-parser 2.0.1) confirm this as genuine arbitrary command execution, not a theoretical issue. Net assessment: prioritize patching because simple-git is extremely widely deployed and the impact is code execution, but note the exploit is CONDITIONAL on how the downstream application handles environment variables - it is not blanket remote exploitation of every simple-git install. Missing data: no independent EPSS/KEV signal to gauge in-the-wild activity.

A Node.js application (e.g., a CI runner, git-automation service, or hosting backend) uses simple-git and forwards user- or request-influenced environment values into Git operations. An attacker sets the VISUAL environment variable to a shell command (e.g., touch /tmp/pwned or a reverse shell) which the pre-2.0.1 argv-parser fails to recognize as an unsafe-editor key, so Git launches it as the editor during a commit --amend or interactive rebase, executing the command with the Node.js process's privileges. A proof-of-concept demonstrating the bypass is embedded in the vendor's fix commit as an integration test.