CVE-2026-102827 is a high severity (CVSS 8.1) flaw in simple-git, the Node.js wrapper for git commands. Its default guard checks for dangerous options by exact spelling, but git accepts abbreviations, so shortened forms can slip through on push. Upgrade to simple-git 4.0.0 or later, and never pass untrusted options to git.
What's affected
The GitHub advisory lists simple-git up to 3.36.0 as affected and 4.0.0 as the patched version. The record says the same: prior to 4.0.0.
Your exposure depends on how you call it. The advisory is about applications that rely on the default unsafe-operations protection while passing attacker-influenced options or arguments into a push. It describes a local or file remote, or an attacker-influenced receive-pack target. If your code never builds git arguments from outside input, your exposure is much smaller.
How to check if you're exposed
Check which version of simple-git you resolve, including through other packages:
npm ls simple-git
npm explain simple-git
Then search your code for where option or config values reach simple-git:
grep -rn "simpleGit\|simple-git" --include=*.js --include=*.ts src/
The question for each call site is whether a user, a repository file, a webhook payload or any other outside input can influence the arguments you pass to a push.
What to do now
- Upgrade simple-git to 4.0.0 or later. If you also need the trailer fix for CVE-2026-102828, use 4.0.1 or later.
- Stop passing user-controlled strings as git options. Accept only values you expect, such as a branch name from an allow list.
- Validate refs and remote names before they reach the library, and reject anything that starts with a hyphen.
- Run git operations in a low-privilege account or a sandbox, so a command that does run has little to reach.
- Rescan after the update to confirm no copy of an old simple-git remains in your lockfile.
Why it matters
simple-git already blocks dangerous options such as --upload-pack, --receive-pack and --exec unless a consumer opts in. The weakness is how it matches them. According to the advisory, the check compares the option name with literal spellings, while git accepts any unambiguous shortened form of a long option. A shortened spelling does not match the pattern but git still expands it. The clone path was protected better than the push path.
That is a classic filter problem. A deny list of spellings will always miss a spelling you did not think of. The record files it under CWE-77 (command injection) and CWE-88 (argument injection). The safer design is to pass values after a separator and to allow only values you expect.
The record does not report exploitation in the wild, and the KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this matter if I only clone public repositories?
The advisory says the clone side handles abbreviations better and describes the gap on the push path. Still, upgrade and avoid passing untrusted options at all.
Sources
Last reviewed: 19 October 2026.
