# simple-git (npm) vulnerabilities 10 known vulnerabilities (3 critical, 7 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.0.2 (Sep 26, 2026): no advisory affects it - Newest unaffected release: 4.0.2 (Sep 26, 2026), the latest release - Weekly downloads: 15.3M - Dependents: 559 - Releases: 277 since 0.0.1 (Aug 9, 2013) - Registry: https://www.npmjs.com/package/simple-git - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-102828: 3.15.0 to 4.0.0 (4.0.1 is outside it) - CVE-2026-102827: 0.0.1 to 3.36.0 (4.0.0 is outside it) - CVE-2026-102826: 0.0.1 to 3.36.0 (4.0.0 is outside it) - CVE-2026-6951: 0.0.1 to 3.35.2 (3.36.0 is outside it) - CVE-2026-28291: 0.0.1 to 3.31.1 (3.32.0 is outside it) - CVE-2026-28292: 3.15.0 to 3.32.2 (3.32.3 is outside it) - CVE-2022-25860: 0.0.1 to 3.15.1 (3.16.0 is outside it) - CVE-2022-25912: 0.0.1 to 3.14.1 (3.15.0 is outside it) - CVE-2022-24066: 0.0.1 to 3.4.0 (3.5.0 is outside it) - CVE-2022-24433: 0.0.1 to 3.2.6 (3.3.0 is outside it) ## Advisories (10) ### [CVE-2026-102828](https://cve.now/CVE-2026-102828): simple-git unsafe-operation guard does not block trailer command configuration - Severity: Critical 9.2 - Published: Sep 29, 2026 - Affected: from 3.15.0, fixed in 4.0.1. - Fixed in 4.0.1 (released Sep 25, 2026, 4 days before disclosure). - The latest release, 4.0.2, is not affected. - 66% of simple-git downloads last week were affected versions (11.8M). ### [CVE-2026-102827](https://cve.now/CVE-2026-102827): simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -\> command execution (residual of CVE-2026-28291) - Severity: High 8.1 - Published: Sep 29, 2026 - Affected: fixed in 4.0.0. - Fixed in 4.0.0 (released Sep 25, 2026, 4 days before disclosure). - The latest release, 4.0.2, is not affected. - 69% of simple-git downloads last week were affected versions (12.5M). ### [CVE-2026-102826](https://cve.now/CVE-2026-102826): simple-git allows command execution through unblocked Git configuration includes - Severity: High 8.1 - Published: Sep 29, 2026 - Affected: fixed in 4.0.0. - Fixed in 4.0.0 (released Sep 25, 2026, 4 days before disclosure). - The latest release, 4.0.2, is not affected. - 69% of simple-git downloads last week were affected versions (12.5M). ### [CVE-2026-6951](https://cve.now/CVE-2026-6951): Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for CVE-2022-25912… - Severity: Critical 9.2 - Published: Apr 25, 2026 - Affected: fixed in 3.36.0. - Fixed in 3.36.0 (released Apr 12, 2026, 13 days before disclosure). - The latest release, 4.0.2, is not affected. - 36% of simple-git downloads last week were affected versions (6.5M). ### [CVE-2026-28291](https://cve.now/CVE-2026-28291): simple-git has Command Execution via Option-Parsing Bypass - Severity: High 8.1 - Published: Apr 13, 2026 - Affected: fixed in 3.32.0. - Fixed in 3.32.0 (released Feb 21, 2026, 51 days before disclosure). - The latest release, 4.0.2, is not affected. - 32% of simple-git downloads last week were affected versions (5.7M). ### [CVE-2026-28292](https://cve.now/CVE-2026-28292): simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE - Severity: Critical 9.8 - Published: Mar 10, 2026 - Affected: from 3.15.0, fixed in 3.32.3. - Fixed in 3.32.3 (released Feb 26, 2026, 12 days before disclosure). - The latest release, 4.0.2, is not affected. - 28% of simple-git downloads last week were affected versions (5.1M). ### [CVE-2022-25860](https://cve.now/CVE-2022-25860): Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and… - Severity: High 8.1 - Published: Jan 24, 2023 - Affected: fixed in 3.16.0. - Fixed in 3.16.0 (released Jan 16, 2023, 8 days before disclosure). - The latest release, 4.0.2, is not affected. - 3.8% of simple-git downloads last week were affected versions (681.7K). ### [CVE-2022-25912](https://cve.now/CVE-2022-25912): Remote Code Execution (RCE) - Severity: High 8.1 - Published: Dec 12, 2022 - Affected: fixed in 3.15.0. - Fixed in 3.15.0 (released Nov 12, 2022, 30 days before disclosure). - The latest release, 4.0.2, is not affected. - 3.7% of simple-git downloads last week were affected versions (657K). ### [CVE-2022-24066](https://cve.now/CVE-2022-24066): Command Injection - Severity: High 8.1 - Published: Apr 1, 2022 - Affected: fixed in 3.5.0. - Fixed in 3.5.0 (released Mar 29, 2022, 3 days before disclosure). - The latest release, 4.0.2, is not affected. - 3.2% of simple-git downloads last week were affected versions (580.2K). ### [CVE-2022-24433](https://cve.now/CVE-2022-24433): Command Injection - Severity: High 8.1 - Published: Mar 11, 2022 - Affected: fixed in 3.3.0. - Fixed in 3.3.0 (released Mar 11, 2022, the day of disclosure). - The latest release, 4.0.2, is not affected. - 3.2% of simple-git downloads last week were affected versions (577.4K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/simple-git Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.