CVE-2026-28292 Details
Description
`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.
A remote code execution vulnerability has been identified in the simple-git library, which is used to run git commands in Node.js applications. This issue affects versions 3.15.0 through 3.32.2 and allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) by exploiting a case-sensitivity flaw in the handling of git protocol configuration keys. The vulnerability arises because Git treats configuration key names as case-insensitive, while the regex used in simple-git's security plugin is case-sensitive, creating a mismatch that can be exploited.
Users are advised to upgrade to simple-git version 3.32.3 or later. If an immediate upgrade is not possible, audit all code paths where user input could reach simple-git method arguments, and validate and sanitize this input before it is passed to simple-git.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
| CWE-76 | Improper Neutralization of Equivalent Special Elements | redhat-SADP |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| simple-git project simple-git | >= 3.15.0, < 3.32.2 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 14, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | CVE Modified | [email protected] |
| Mar 12, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |