{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T19:18:13.460Z", "lastRun": "2026-10-23T19:01:02.861Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "steveukx" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-102829", "url": "https://cveboard.org/i/cve-2026-102829", "urlPt": "https://cveboard.org/pt/i/cve-2026-102829", "json": "https://cveboard.org/i/cve-2026-102829.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection", "summary": "GitEnvKeys in packages/argv-parser/src/env/parse-env.ts maps only editor, git_editor and git_sequence_editor to the allowUnsafeEditor category. prepareEnv keeps an environment entry only when its lowercased name is a known GitEnvKey or starts with git, so VISUAL is discarded before collectConfigVulnerabilities ever inspects it.", "titlePt": "simple-git: variável de ambiente `VISUAL` do editor é omitida da detecção de editor inseguro", "summaryPt": "GitEnvKeys em packages/argv-parser/src/env/parse-env.ts mapeia apenas editor, git_editor e git_sequence_editor para a categoria allowUnsafeEditor. prepareEnv mantém uma entrada de ambiente apenas quando seu nome em minúsculas é uma GitEnvKey conhecida ou começa com git, então VISUAL é descartado antes de collectConfigVulnerabilities inspecioná-lo.", "affected": [ { "vendor": "steveukx", "product": "git-js", "defaultStatus": "unknown", "versions": [ { "version": "< 2.0.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, { "id": "CWE-184", "name": "Incomplete List of Disallowed Inputs" } ], "ssvc": { "exploitation": "poc", "automatable": "no", "impact": "total", "at": "2026-09-30T19:28:19.341Z" }, "fix": "listed", "tags": [ "steveukx", "npm" ], "cves": [ "CVE-2026-102829" ], "ghsa": "GHSA-v5rq-49vh-5v5c", "cvss": { "score": 9.2, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00275, "percentile": 0.18869, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "npm", "name": "@simple-git/argv-parser", "vulnerable": "< 2.0.1", "fixed": "2.0.1", "advisory": "GHSA-v5rq-49vh-5v5c" } ], "vendor": "steveukx", "product": "git-js", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-v5rq-49vh-5v5c" } ], "publishedAt": "2026-10-05T23:48:21.000Z", "updatedAt": "2026-10-05T23:48:21.000Z" }, { "id": "cve-2026-102828", "url": "https://cveboard.org/i/cve-2026-102828", "urlPt": "https://cveboard.org/pt/i/cve-2026-102828", "json": "https://cveboard.org/i/cve-2026-102828.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "simple-git unsafe-operation guard does not block trailer command configuration", "summary": "The default blockUnsafeOperationsPlugin in simple-git when an application permits untrusted values to reach SimpleGitOptions.config or Git inline configuration arguments such as -c =.", "titlePt": "O guardião de operações inseguras do simple-git não bloqueia a configuração de comandos trailer", "summaryPt": "O plugin blockUnsafeOperationsPlugin padrão no simple-git quando uma aplicação permite que valores não confiáveis alcancem SimpleGitOptions.config ou argumentos de configuração inline do Git como -c =", "affected": [ { "vendor": "steveukx", "product": "git-js", "defaultStatus": "unknown", "versions": [ { "version": ">= 3.15.0, < 4.0.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, { "id": "CWE-184", "name": "Incomplete List of Disallowed Inputs" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-09-30T20:08:07.142Z" }, "fix": "listed", "tags": [ "steveukx", "npm" ], "cves": [ "CVE-2026-102828" ], "ghsa": "GHSA-x6jw-m9v5-85vh", "cvss": { "score": 9.2, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00375, "percentile": 0.30251, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "npm", "name": "simple-git", "vulnerable": ">= 3.15.0, < 4.0.1", "fixed": "4.0.1", "advisory": "GHSA-x6jw-m9v5-85vh" } ], "vendor": "steveukx", "product": "git-js", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-x6jw-m9v5-85vh" } ], "publishedAt": "2026-10-05T23:48:14.000Z", "updatedAt": "2026-10-05T23:48:14.000Z" } ], "tag": { "tag": "steveukx", "name": "steveukx", "kev": null } }