CVE-2026-102828
simple-git unsafe-operation guard does not block trailer command configuration
The default blockUnsafeOperationsPlugin in simple-git when an application permits untrusted values to reach SimpleGitOptions.config or Git inline configuration arguments such as -c <key>=<value>.
- No known exploitation
- Severity
- Critical, CVSS 9.2 (v4.0)
- EPSS
- 0.38% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- simple-git (npm) >= 3.15.0, < 4.0.1, fixed in 4.0.1 · GHSA-x6jw-m9v5-85vh