Git Option Manipulation Flaw Bypasses Safety Checks

A critical vulnerability, tracked as CVE-2026-28291, has been identified in simple-git versions up to and including 3.31.1. This library, designed to execute native Git commands from JavaScript, harbors a flaw allowing arbitrary command execution. The issue stems from an incomplete patch for an earlier vulnerability, CVE-2022-25860, which attempted to block dangerous Git options like -u and --upload-pack.

According to the National Vulnerability Database, the core problem lies in Git’s highly flexible option parsing. Attackers can leverage numerous character combinations, such as -vu, -4u, or -nu, to effectively bypass the regular-expression-based blocklist implemented in the unsafe operations plugin. This sophisticated evasion technique demonstrates a significant challenge for blocklist-based mitigations, as the sheer volume of valid option variants makes comprehensive blocking virtually impossible without fully emulating Git’s parsing behavior. The National Vulnerability Database indicates this high-severity flaw has been addressed in simple-git version 3.32.0, urging immediate updates.