simple-git
npm10 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting simple-gitpage 1 of 1
- CVE-2022-24066HIGHCVSS 8.1EG 8.1fixed in 3.5.02022-04-01
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar…
- CVE-2022-24433HIGHCVSS 8.1EG 8.1fixed in 3.3.02022-03-11
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By i…
- CVE-2022-25860HIGHCVSS 8.1EG 8.1fixed in 3.16.02023-01-26
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix…
- CVE-2022-25912HIGHCVSS 8.1EG 8.1fixed in 3.15.02022-12-06
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-240…
- CVE-2026-102826HIGHCVSS 8.1EG 8.1fixed in 4.0.02026-09-29
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration …
- CVE-2026-102827CRITICALCVSS 9.8EG 9.8fixed in 4.0.02026-09-29
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal…
- CVE-2026-102828CRITICALCVSS 9.8EG 9.8fixed in 4.0.12026-09-29
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token…
- CVE-2026-28291HIGHCVSS 8.1EG 8.1fixed in 3.32.02026-04-13
simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and…
- CVE-2026-28292CRITICALCVSS 9.8EG 9.8fixed in 3.32.32026-03-10
`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remot…
- CVE-2026-6951CRITICALCVSS 9.8EG 9.8fixed in 3.36.02026-04-25
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equ…
Check whether simple-git is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for simple-git CVEs against the assets you own.
Book a Demo →