steveukx/git-js Security Advisories | GitStock

critical2026-10-05

simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

GHSA-v5rq-49vh-5v5c · CVE-2026-102829

critical2026-10-05

simple-git unsafe-operation guard does not block trailer command configuration

GHSA-x6jw-m9v5-85vh · CVE-2026-102828

high2026-10-05

simple-git allows command execution through unblocked Git configuration includes

GHSA-g4wm-2vf7-vfgr · CVE-2026-102826

high2026-10-05

simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

GHSA-858h-whjf-mvg5 · CVE-2026-102827

high2026-04-25

simple-git is vulnerable to Remote Code Execution

GHSA-hffm-xvc3-vprc · CVE-2026-6951

high2026-04-13

simple-git Affected by Command Execution via Option-Parsing Bypass

GHSA-jcxm-m3jx-f287 · CVE-2026-28291

critical2026-03-10

simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE

GHSA-r275-fr43-pm7q · CVE-2026-28292

high2022-12-06

simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol

GHSA-9p95-fxvg-qgq2 · CVE-2022-25912