CVE-2026-28292

Description

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.

PUBLISHED Reserved 2026-02-26 | Published 2026-03-10 | Updated 2026-03-11 | Assigner GitHub_M

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-178: Improper Handling of Case Sensitivity

Product status

References

www.codeant.ai/...e-git-remote-code-execution-cve-2026-28292

github.com/...ommit/f7042088aa2dac59e3c49a84d7a2f4b26048a257

cve.org (CVE-2026-28292)

nvd.nist.gov (CVE-2026-28292)

Download JSON