CVE-2026-102826

Name of the Vulnerable Software and Affected Versions simple-git versions prior to 4.0.0

Description The default blockUnsafeOperationsPlugin fails to fully reject configuration includes provided via customArgs to the git.clone() function. This allows Git to load an attacker-controlled configuration file through include.path or includeIf.<condition>.path. A malicious configuration can define an executable Git option, such as core.sshCommand, which is then executed with the privileges of the Node.js process during the clone operation. Successful exploitation requires the application to accept attacker-influenced custom arguments and the existence of a readable attacker-controlled file.

Recommendations Update to version 4.0.0.