Skip to main content
cve.nowby Sazabi
← npm
npmPackage

simple-git

10 known vulnerabilities (3 critical, 7 high), with the versions each affects and the releases that fix them.

Latest release
4.0.2 (Sep 26, 2026): no advisory affects it
Newest unaffected release
4.0.2 (Sep 26, 2026), the latest release
Advisories
10 · 3 critical, 7 high
Weekly downloads
15.3M
Dependents
559
Releases
277 since 0.0.1 (Aug 9, 2013)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

  • CVE-2026-102828Critical 9.2

    simple-git unsafe-operation guard does not block trailer command configuration

    Affected: from 3.15.0, fixed in 4.0.1.

    Fixed in 4.0.1 (released Sep 25, 2026, 4 days before disclosure).

    The latest release, 4.0.2, is not affected.

    66% of simple-git downloads last week were affected versions (11.8M).

  • simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

    Affected: fixed in 4.0.0.

    Fixed in 4.0.0 (released Sep 25, 2026, 4 days before disclosure).

    The latest release, 4.0.2, is not affected.

    69% of simple-git downloads last week were affected versions (12.5M).

  • simple-git allows command execution through unblocked Git configuration includes

    Affected: fixed in 4.0.0.

    Fixed in 4.0.0 (released Sep 25, 2026, 4 days before disclosure).

    The latest release, 4.0.2, is not affected.

    69% of simple-git downloads last week were affected versions (12.5M).

  • CVE-2026-6951Critical 9.2

    Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for CVE-2022-25912…

    Affected: fixed in 3.36.0.

    Fixed in 3.36.0 (released Apr 12, 2026, 13 days before disclosure).

    The latest release, 4.0.2, is not affected.

    36% of simple-git downloads last week were affected versions (6.5M).

  • simple-git has Command Execution via Option-Parsing Bypass

    Affected: fixed in 3.32.0.

    Fixed in 3.32.0 (released Feb 21, 2026, 51 days before disclosure).

    The latest release, 4.0.2, is not affected.

    32% of simple-git downloads last week were affected versions (5.7M).

  • CVE-2026-28292Critical 9.8

    simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE

    Affected: from 3.15.0, fixed in 3.32.3.

    Fixed in 3.32.3 (released Feb 26, 2026, 12 days before disclosure).

    The latest release, 4.0.2, is not affected.

    28% of simple-git downloads last week were affected versions (5.1M).

  • Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and…

    Affected: fixed in 3.16.0.

    Fixed in 3.16.0 (released Jan 16, 2023, 8 days before disclosure).

    The latest release, 4.0.2, is not affected.

    3.8% of simple-git downloads last week were affected versions (681.7K).

  • Remote Code Execution (RCE)

    Affected: fixed in 3.15.0.

    Fixed in 3.15.0 (released Nov 12, 2022, 30 days before disclosure).

    The latest release, 4.0.2, is not affected.

    3.7% of simple-git downloads last week were affected versions (657K).

  • Command Injection

    Affected: fixed in 3.5.0.

    Fixed in 3.5.0 (released Mar 29, 2022, 3 days before disclosure).

    The latest release, 4.0.2, is not affected.

    3.2% of simple-git downloads last week were affected versions (580.2K).

  • Command Injection

    Affected: fixed in 3.3.0.

    Fixed in 3.3.0 (released Mar 11, 2022, the day of disclosure).

    The latest release, 4.0.2, is not affected.

    3.2% of simple-git downloads last week were affected versions (577.4K).