simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck...
Vendor
steveukx vulnerabilities
6 published CVES affecting steveukx, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 6
- Critical
- 4
- High
- 2
- Medium
- 0
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
Latest steveukx CVEs
Newest publication first
-
CriticalCVSS 9.2 EPSS 0.35%
-
CVE-2026-102828 simple-git unsafe-operation guard does not block trailer command configuration
PublishedCriticalCVSS 9.2 EPSS 0.37%simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An applica...
-
CriticalCVSS 9.8 EPSS 0.58%
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git acc...
-
CVE-2026-102826 simple-git allows command execution through unblocked Git configuration includes
PublishedHighCVSS 8.1 EPSS 0.46%simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to g...
-
HighCVSS 8.1 EPSS 0.80%
simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an in...
-
CriticalCVSS 9.8 EPSS 1.4%
simple-git, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Versi...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.