Summary
generated automatically from NVD dataIn simple-git, a Node.js interface for running Git commands, the default blockUnsafeOperationsPlugin fails to treat trailer.<token>.cmd as unsafe configuration, affecting versions from 3.15.0 until 4.0.1. If an application passes attacker-controlled values via SimpleGitOptions.config or inline -c arguments, Git can run an attacker-chosen shell command when git interpret-trailers processes the trailer, with the permissions of the Node.js process (CWE-78). The issue is rated CRITICAL with a CVSS v3.1 score of 9.8 and is fixed in 4.0.1.
NVD description
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.
EPSS · FIRST.org
0.38%probability of exploitation in the next 30 days
Higher than 29% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 29 sept. 2026
- Updated
- 8 oct. 2026
- Status
- Analyzed
- Source
- security-advisories@github.com
Affected products
Weaknesses (CWE)
References (4)
- https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vhMitigationVendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-78
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.