CVE-2026-28291

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.

• CWE-78
• CWE-78

• https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26Product
• https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2dPatch
• https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0Release Notes
• https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287Exploit, Vendor Advisory
• https://www.cve.org/CVERecord?id=CVE-2022-25860Third Party Advisory, VDB Entry
• https://access.redhat.com/security/cve/CVE-2026-28291
• https://bugzilla.redhat.com/show_bug.cgi?id=2457930
• https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287Exploit, Vendor Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28291.json

Published

Apr 13, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28282Discourse is an open-source discussion platform. Versions pr…6.5
• CVE-2026-28284FreePBX is an open source IP PBX. Prior to versions 16.0.10 …8.8
• CVE-2026-28286ZimaOS is a fork of CasaOS, an operating system for Zima dev…9.9
• CVE-2026-28287FreePBX is an open source IP PBX. From versions 16.0.17.2 to…8.8
• CVE-2026-28288Dify is an open-source LLM app development platform. Prior t…5.3
• CVE-2026-28289FreeScout is a free help desk and shared inbox built with PH…8.1
• CVE-2026-28292`simple-git`, an interface for running git commands in any n…9.8
• CVE-2026-28295A flaw was found in the FTP GVfs backend. A malicious FTP se…4.3
• CVE-2026-28296A flaw was found in the FTP GVfs backend. A remote attacker …4.3
• CVE-2026-28297SolarWinds Observability Self-Hosted was found to be affecte…8.7
• CVE-2026-28298SolarWinds Observability Self-Hosted was found to be affecte…8.1
• CVE-2026-28299SolarWinds Web Help Desk is found to be affected by a denial…7.5