CVE-2026-102828 is a critical (CVSS 9.8) flaw in simple-git, the Node.js git wrapper. Its default guard does not treat a trailer command setting as unsafe, so attacker-controlled config values can make git run a shell command. The fix is simple-git 4.0.1. Upgrade, and keep untrusted values out of config and git arguments.
What's affected
The GitHub advisory lists simple-git from 3.15.0 through 3.36.0 as affected, and 4.0.1 as the patched version. The record says from 3.15.0 until 4.0.1.
The advisory is clear about preconditions. The application must use an affected version with the default unsafe-operation plugin active, and must pass attacker-controlled data into instance configuration or git command arguments that set a trailer command. The git binary must support the documented trailer command behavior and the app must run git interpret-trailers with that setting in scope. The command then runs with the identity and permissions of your Node.js process.
How to check if you're exposed
Check which version of simple-git you resolve, including through other packages:
npm ls simple-git
npm explain simple-git
Then search your code for where option or config values reach simple-git:
grep -rn "simpleGit\|simple-git" --include=*.js --include=*.ts src/
The question for each call site is whether a user, a repository file, a webhook payload or any other outside input can influence the config object or any inline config arguments.
What to do now
- Upgrade simple-git to 4.0.1 or later. That also covers CVE-2026-102827, which needs 4.0.0.
- Do not build
SimpleGitOptions.configor inline config arguments from outside input. Use fixed values. - If you must accept settings, allow only a short list of exact keys and reject everything else.
- Run the Node.js process with minimal rights, because the command inherits them.
- Review other places where your code passes user input to child processes, not only git.
Why it matters
This is the second gap of its kind in the same guard. The plugin keeps a list of configuration keys that are unsafe to set, such as an editor command. The advisory says it had no entry for the trailer command key, which git documents as a shell command run by git interpret-trailers. A list of known-bad keys is only as good as the list.
The record files it under CWE-184 (incomplete list of disallowed inputs) and CWE-78 (OS command injection). The practical lesson is to flip the logic: allow a few settings you need and refuse the rest.
The record does not report exploitation in the wild, and the KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is my app exposed if I never set config from user input?
The advisory's preconditions require attacker-controlled data to reach the config or inline arguments. If nothing outside your control does, the described path is not open. Upgrading is still the right move.
Sources
Last reviewed: 19 October 2026.
