{
  "schemaVersion": 1,
  "incident": {
    "id": "cve-2026-102829",
    "url": "https://cveboard.org/i/cve-2026-102829",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-102829",
    "json": "https://cveboard.org/i/cve-2026-102829.json",
    "kind": "vuln",
    "live": false,
    "knownExploited": false,
    "severity": "critical",
    "title": "simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection",
    "summary": "GitEnvKeys in packages/argv-parser/src/env/parse-env.ts maps only editor, git_editor and git_sequence_editor to the allowUnsafeEditor category. prepareEnv keeps an environment entry only when its lowercased name is a known GitEnvKey or starts with git, so VISUAL is discarded before collectConfigVulnerabilities ever inspects it.",
    "titlePt": "simple-git: variável de ambiente `VISUAL` do editor é omitida da detecção de editor inseguro",
    "summaryPt": "GitEnvKeys em packages/argv-parser/src/env/parse-env.ts mapeia apenas editor, git_editor e git_sequence_editor para a categoria allowUnsafeEditor. prepareEnv mantém uma entrada de ambiente apenas quando seu nome em minúsculas é uma GitEnvKey conhecida ou começa com git, então VISUAL é descartado antes de collectConfigVulnerabilities inspecioná-lo.",
    "cves": [
      "CVE-2026-102829"
    ],
    "ghsa": "GHSA-v5rq-49vh-5v5c",
    "cvss": {
      "score": 9.2,
      "version": "4.0"
    },
    "epss": {
      "percentage": 0.00275,
      "percentile": 0.18509,
      "asOf": "2026-10-23"
    },
    "packages": [
      {
        "ecosystem": "npm",
        "name": "@simple-git/argv-parser",
        "vulnerable": "< 2.0.1",
        "fixed": "2.0.1",
        "advisory": "GHSA-v5rq-49vh-5v5c"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-v5rq-49vh-5v5c"
      }
    ],
    "publishedAt": "2026-10-05T23:48:21.000Z",
    "updatedAt": "2026-10-05T23:48:21.000Z"
  },
  "live": false,
  "events": [
    {
      "id": "ghsa:GHSA-v5rq-49vh-5v5c:ghsa_published:2026-10-05T23:48:21.000Z",
      "incidentId": "cve-2026-102829",
      "type": "ghsa_published",
      "at": "2026-10-05T23:48:21.000Z",
      "detail": {
        "ghsa": "GHSA-v5rq-49vh-5v5c",
        "severity": "critical",
        "fixed": "2.0.1"
      }
    }
  ]
}