CVE-2026-102828

About vulnerability

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.

Affected product:

AlmaLinux 9.2 ESU , Node.js , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Vue , ai-sdk-harness-cline , braintrust-sdk-javascript , cline , cline-llms , cline-sdk , cline-shared , create-strapi , create-strapi-app , create-zephyr-apps , datadog-ci , devtools , git-js , mastra-braintrust , netlify-cms-proxy-server , nuxt , nuxt-devtools-ui-kit , nuxt-docs , nuxt-kit , nuxt-nitro-server , nuxt-rspack-builder , nuxt-schema , nuxt-vite-builder , nuxt-vite-server , nuxt-webpack-builder , parcel , parcel-bundler-default , parcel-events , parcel-feature-flags , parcel-markdown-ansi , parcel-namer-default , parcel-optimizer-css , parcel-optimizer-html , parcel-optimizer-image , parcel-optimizer-swc , parcel-packager-css , parcel-packager-html , parcel-packager-js , parcel-reporter-dev-server , parcel-runtime-browser-hmr , parcel-runtime-js , parcel-runtime-rsc , parcel-runtime-service-worker , parcel-rust , parcel-rust-linux-arm64-gnu , parcel-rust-linux-arm64-musl , parcel-rust-linux-x64-gnu , parcel-transformer-babel , parcel-transformer-css , parcel-transformer-html , parcel-transformer-json , parcel-transformer-node , parcel-transformer-postcss , parcel-transformer-posthtml , parcel-transformer-svg , parcel-utils , powersync-nuxt , rollup-plugin-zephyr , sentry-nuxt , strapi , strapi-admin , strapi-cloud-cli , strapi-content-manager , strapi-content-releases , strapi-content-type-builder , strapi-core , strapi-data-transfer , strapi-database , strapi-email , strapi-generators , strapi-i18n , strapi-logger , strapi-openapi , strapi-permissions , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-provider-email-mailgun , strapi-provider-email-nodemailer , strapi-provider-email-sendgrid , strapi-provider-upload-aws-s3 , strapi-provider-upload-cloudinary , strapi-provider-upload-local , strapi-review-workflows , strapi-strapi , strapi-types , strapi-typescript-utils , strapi-upgrade , strapi-upload , strapi-utils , tobilu-qmd , virmator , virmator-init , virmator-publish , vite-plugin-tanstack-start-zephyr , vite-plugin-vinext-zephyr , vite-plugin-zephyr , with-zephyr , wordpress-env , yeoman-generator , zephyr-agent , zephyr-astro-integration , zephyr-edge-contract , zephyr-metro-plugin , zephyr-modernjs-plugin , zephyr-native-cache , zephyr-nuxt-module , zephyr-packages , zephyr-repack-plugin , zephyr-rolldown-plugin , zephyr-rsbuild-plugin , zephyr-rspack-plugin , zephyr-rspress-plugin , zephyr-tap-runtime , zephyr-webpack-plugin , zephyr-xpack-internal

Affected packages:

simple-git @ 3.36.0 (+1420 more)