CVE-2026-28292

CRITICAL EPSS 66.2%
Published Mar 10, 20263mo ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Mar 10, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
66.2% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-178
CWE-78 OS Command Injection Injection

Affected Products 1

VendorProductVersionRange
simple-git_projectsimple-git*≥3.15.0  –  <3.32.2

References 4

  • github.com https://github.com/steveukx/git-js/commit/f7042088aa2dac59e3c49a84d7a2f4b26048a257
    Patch
  • github.com https://github.com/steveukx/git-js/security/advisories/GHSA-r275-fr43-pm7q
  • codeant.ai https://www.codeant.ai/security-research/security-research-simple-git-remote-code-execution-cve-2026-28292
    ExploitThird Party Advisory
  • codeant.ai https://www.codeant.ai/security-research/simple-git-remote-code-execution-cve-2026-28292

Remediation

  • github.com https://github.com/steveukx/git-js/commit/f7042088aa2dac59e3c49a84d7a2f4b26048a257
    Patch