Executive brief
simple-git, a popular Node.js library used to automate Git commands, contains a critical security flaw that allows attackers to execute arbitrary commands on the host server. By providing specially crafted input that uses uppercase letters to bypass security filters, an attacker can take full control of the system running the application. This vulnerability effectively undoes previous security patches and could lead to complete data theft or system compromise.
Technical details
A vulnerability exists in simple-git's blockUnsafeOperationsPlugin where the preventProtocolOverride function uses a case-sensitive regular expression to check for unsafe '-c protocol.allow' arguments. Because Git treats configuration keys case-insensitively, an attacker can bypass this check by using uppercase or mixed-case variants (e.g., 'PROTOCOL.ALLOW'). This bypass allows the enablement of the 'ext::' protocol, which can be leveraged to execute arbitrary shell commands on the host machine. The issue affects versions 3.15.0 through 3.32.2 and is addressed in version 3.32.3 by adding the case-insensitive flag to the validation regex.
Affected products
- steveukx simple-git >= 3.15.0, < 3.32.3
- Red Hat Logging Subsystem for Red Hat OpenShift 5
Timeline
- 2026-03-10: disclosed
- 2026-03-10: advisory
- 2026-04-12: patched: Version 3.32.3 released with fix
References
- https://github.com/steveukx/git-js/commit/f7042088aa2dac59e3c49a84d7a2f4b26048a257
- https://github.com/steveukx/git-js/security/advisories/GHSA-r275-fr43-pm7q
- https://www.codeant.ai/security-research/security-research-simple-git-remote-code-execution-cve-2026-28292
- https://access.redhat.com/security/cve/CVE-2026-28292
- https://bugzilla.redhat.com/show_bug.cgi?id=2446162
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28292.json
- https://www.codeant.ai/security-research/simple-git-remote-code-execution-cve-2026-28292