The CVE-2026-28291 vulnerability affects the simple-git package, enabling execution of arbitrary commands through Git option manipulation. This issue arises from an incomplete fix for CVE-2022-25860 and stems from Git's flexible option parsing, which allows numerous character combinations to bypass safety checks. The flaw has been fixed in version 3.32.0. Users should update to this version or apply mitig [truncated]
CVE-2026-28292 is a critical vulnerability in Simple-Git, a widely-used interface for running git commands in Node.js applications. The vulnerability, with a CVSS score of 9.8, allows an attacker to bypass previous fixes for CVE-2022-25860 and CVE-2022-25912, achieving full remote code execution on the host machine. The issue affects versions 3.15.0 through 3.32.2 of Simple-Git. An updated fix is availabl [truncated]
