{"id":"CVE-2026-102827","aliases":["CLSA-2026-1791973734","EUVD-2026-89333","GHSA-858h-whjf-mvg5"],"status":"published","title":"simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -\u003e command execution (residual of CVE-2026-28291)","description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00576,"percentile":0.48025,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-77","CWE-88"],"published":"2026-09-29T18:39:57Z","modified":"2026-10-31T16:24:12Z","exploits":[{"source":"pocgithub","id":"D7EAD/CVE-2026-102827","title":"D7EAD/CVE-2026-102827","date":"2026-10-13","url":"https://github.com/D7EAD/CVE-2026-102827"}],"fixes":[{"ecosystem":"npm","package":"simple-git","fixed_in":["4.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"simple-git","fixed_in":["3.36.0-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"simple-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.36.0"},{"fixed":"4.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"simple-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.36.0-tuxcare.0"},{"fixed":"3.36.0-tuxcare.2"}]}],"versions":["3.36.0","3.36.0-tuxcare.1"]},{"source":"osv","ecosystem":"npm","package":"simple-git","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.0.0"}]}]}],"products":[{"vendor":"simple-git_project","product":"simple-git"},{"vendor":"steveukx","product":"git-js"}],"references":[{"url":"https://github.com/steveukx/git-js/security/advisories/GHSA-858h-whjf-mvg5","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/steveukx/git-js/pull/1193","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102827","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-858h-whjf-mvg5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102827.json","tags":["advisory"]},{"url":"https://github.com/steveukx/git-js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-102827","title":"simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -\u003e command execution (residual of CVE-2026-28291)","description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0.","status":"published","published":"2026-09-29T18:39:57.688Z","modified":"2026-10-02T12:21:16.544Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-77","CWE-88"],"updated_at":"2026-11-02T13:38:54.394896Z"}],"euvd":[{"id":"EUVD-2026-89333","description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0.","status":"published","published":"2026-09-29T18:39:57Z","modified":"2026-10-02T12:21:16Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:43.134956Z"}],"ghsa":[{"id":"GHSA-858h-whjf-mvg5","title":"simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -\u003e command execution (residual of CVE-2026-28291)","description":"simple-git's blockUnsafeOperationsPlugin blocks dangerous git options (--upload-pack/--receive-pack/--exec/...) unless the consumer opts in via unsafe:{allowUnsafePack:true}. Detection (@simple-git/argv-parser detectVulnerableFlags) matches the parsed flag NAME against literal-spelling patterns: /--(upload|receive)-pack/ (requires the literal '-pack') and the string '--exec'. But git accepts unambiguous prefix abbreviations of long options, and expandToken (token-expander.ts) returns the LITERAL token as flag.name (it uses the spec only for needsNext, never to canonicalize). So `git push --receive-p=\u003ccmd\u003e` parses with flag.name='--receive-p', which /--(upload|receive)-pack/ does NOT match, yet git expands --receive-p -\u003e --receive-pack and runs \u003ccmd\u003e (on a local/file remote, locally). The clone side is robust (its '--u' substring rule catches every --upload* abbreviation); the push --receive-* and --exe* abbreviations have no equivalent rule and slip through.\n\nProof of concept (latest: simple-git 3.36.0, @simple-git/argv-parser 1.1.1, default unsafe plugin ON):\nGate vulnerabilityCheck: 'push --receive-pack=touch...' -\u003e BLOCKED; 'push --receive-pa=touch...' and 'push --receive-p=touch...' -\u003e BYPASS (empty vulns); '--exec=' BLOCKED, '--exe=' BYPASS.\nEnd-to-end via simpleGit().push():\n  CONTROL git.push(['../bare','HEAD:refs/heads/c','--receive-pack=touch /tmp/pwned_ctrl;']) -\u003e throws GitPluginError 'Use of --upload-pack or --receive-pack is not permitted...'; no command runs.\n  BYPASS  git.push(['../bare','HEAD:refs/heads/e2e','--receive-p=touch /tmp/pwned_e2e;']) -\u003e NO GitPluginError; /tmp/pwned_e2e CREATED (git executed the injected command); only a later GitError surfaces.\nDirect git confirms `git push ../bare --receive-p='touch X;' HEAD:refs/heads/m` and `--exe='touch Y;'` both execute on a local/path remote.\n\nImpact: any app relying on simple-git's default unsafe-operations protection while passing attacker-influenced options/args into a git push (local/file remote, or attacker-influenced receive-pack target) can be made to execute arbitrary commands -- the exact protection CVE-2026-28291 provided, defeated by an abbreviated spelling. Same class/impact as GHSA-jcxm-m3jx-f287, on the push path.\n\nRemediation: canonicalize git option abbreviations before matching (resolve to the canonical long name via the per-task flag spec in expandToken), or match on the option stem/prefix down to the shortest unambiguous form for push receive-pack/exec (mirroring the clone-side '--u' approach). Also audit --template and -c/config-write detection for the same abbreviation gap.\n\nCredit: anir0y (independent security research).","status":"published","published":"2026-10-05T23:47:58Z","modified":"2026-10-31T16:24:12Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-88"],"updated_at":"2026-11-02T14:41:42.013329Z"}],"nvd":[{"id":"CVE-2026-102827","description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0.","status":"published","published":"2026-09-29T19:17:25.05Z","modified":"2026-10-08T20:11:17.64Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-77","CWE-88"],"updated_at":"2026-11-02T14:12:52.759595Z"}],"osv":[{"id":"CVE-2026-102827","title":"simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -\u003e command execution (residual of CVE-2026-28291)","description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0.","status":"published","published":"2026-09-29T18:39:57.688Z","modified":"2026-10-28T02:30:22.478888928Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-88"],"updated_at":"2026-11-02T15:44:53.83521Z"},{"id":"GHSA-858h-whjf-mvg5","title":"simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -\u003e command execution (residual of CVE-2026-28291)","description":"simple-git's blockUnsafeOperationsPlugin blocks dangerous git options (--upload-pack/--receive-pack/--exec/...) unless the consumer opts in via unsafe:{allowUnsafePack:true}. Detection (@simple-git/argv-parser detectVulnerableFlags) matches the parsed flag NAME against literal-spelling patterns: /--(upload|receive)-pack/ (requires the literal '-pack') and the string '--exec'. But git accepts unambiguous prefix abbreviations of long options, and expandToken (token-expander.ts) returns the LITERAL token as flag.name (it uses the spec only for needsNext, never to canonicalize). So `git push --receive-p=\u003ccmd\u003e` parses with flag.name='--receive-p', which /--(upload|receive)-pack/ does NOT match, yet git expands --receive-p -\u003e --receive-pack and runs \u003ccmd\u003e (on a local/file remote, locally). The clone side is robust (its '--u' substring rule catches every --upload* abbreviation); the push --receive-* and --exe* abbreviations have no equivalent rule and slip through.\n\nProof of concept (latest: simple-git 3.36.0, @simple-git/argv-parser 1.1.1, default unsafe plugin ON):\nGate vulnerabilityCheck: 'push --receive-pack=touch...' -\u003e BLOCKED; 'push --receive-pa=touch...' and 'push --receive-p=touch...' -\u003e BYPASS (empty vulns); '--exec=' BLOCKED, '--exe=' BYPASS.\nEnd-to-end via simpleGit().push():\n  CONTROL git.push(['../bare','HEAD:refs/heads/c','--receive-pack=touch /tmp/pwned_ctrl;']) -\u003e throws GitPluginError 'Use of --upload-pack or --receive-pack is not permitted...'; no command runs.\n  BYPASS  git.push(['../bare','HEAD:refs/heads/e2e','--receive-p=touch /tmp/pwned_e2e;']) -\u003e NO GitPluginError; /tmp/pwned_e2e CREATED (git executed the injected command); only a later GitError surfaces.\nDirect git confirms `git push ../bare --receive-p='touch X;' HEAD:refs/heads/m` and `--exe='touch Y;'` both execute on a local/path remote.\n\nImpact: any app relying on simple-git's default unsafe-operations protection while passing attacker-influenced options/args into a git push (local/file remote, or attacker-influenced receive-pack target) can be made to execute arbitrary commands -- the exact protection CVE-2026-28291 provided, defeated by an abbreviated spelling. Same class/impact as GHSA-jcxm-m3jx-f287, on the push path.\n\nRemediation: canonicalize git option abbreviations before matching (resolve to the canonical long name via the per-task flag spec in expandToken), or match on the option stem/prefix down to the shortest unambiguous form for push receive-pack/exec (mirroring the clone-side '--u' approach). Also audit --template and -c/config-write detection for the same abbreviation gap.\n\nCredit: anir0y (independent security research).","status":"published","published":"2026-10-05T23:47:58Z","modified":"2026-10-06T00:00:10.392204845Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-88"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"CLSA-2026-1791973734","title":"TuxCare security update for simple-git (1 CVE)","description":"TuxCare rebuilt simple-git to address 1 CVE. Fixed in 3.36.0-tuxcare.2.","status":"published","published":"2026-10-14T10:28:54Z","modified":"2026-10-15T09:47:40.389569071Z","updated_at":"2026-11-02T15:43:50.599064Z"}]}}