Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

simple-git may let attackers run code

CVE-2026-102827 · published today
Summary

The simple-git library, used in several Node.js projects, had a flaw that could let an attacker execute unwanted code on your system. Updating to the newly released versions of simple-git (or the patched packages listed) will close the gap and keep your applications safe.

What to do
  • Update simple-git to version 4.0.0.
  • Update simple-git to version 3.36.0-aikido.3.
  • Update rootio @rootio/simple-git to version 3.36.0-root.io.3.
  • Update simple-git to version 3.28.0-aikido.4.
  • Update rootio @rootio/simple-git to version 3.28.0-root.io.4.
  • Update simple-git to version 3.16.0-aikido.3.
  • Update rootio @rootio/simple-git to version 3.16.0-root.io.3.
  • Update simple-git to version 3.16.0-aikido.5.
  • Update rootio @rootio/simple-git to version 3.16.0-root.io.5.
  • Update simple-git to version 3.16.0-aikido.7.
  • Update rootio @rootio/simple-git to version 3.16.0-root.io.7.
  • Update simple-git to version 3.7.1-aikido.2.
  • Update rootio @rootio/simple-git to version 3.7.1-root.io.2.
  • Update simple-git to version 3.7.1-aikido.3.
  • Update rootio @rootio/simple-git to version 3.7.1-root.io.3.
  • Update simple-git to version 3.10.0-aikido.3.
  • Update rootio @rootio/simple-git to version 3.10.0-root.io.3.
  • Update simple-git_project simple-git to version 4.0.0 or later.
Affected software
Ecosystem VendorProductAffected versions
– steveukx git-js < 4.0.0
npm – simple-git <= 3.36.0
Fix: upgrade to 4.0.0
– simple-git_project simple-git < 4.0.0
cpe:2.3:a:simple-git_project:simple-git:*:*:*:*:*:node.js:*:*
Root:npm – simple-git < 3.36.0-aikido.3
< 3.28.0-aikido.4
< 3.16.0-aikido.3
< 3.16.0-aikido.5
< 3.16.0-aikido.7
< 3.7.1-aikido.2
< 3.7.1-aikido.3
< 3.10.0-aikido.3
Fix: upgrade to 3.36.0-aikido.3
Root:npm rootio @rootio/simple-git < 3.36.0-root.io.3
< 3.28.0-root.io.4
< 3.16.0-root.io.3
< 3.16.0-root.io.5
< 3.16.0-root.io.7
< 3.7.1-root.io.2
< 3.7.1-root.io.3
< 3.10.0-root.io.3
Fix: upgrade to 3.36.0-root.io.3
Original advisory text
CVE-2026-102827 in simple-git - Patched by Root
Root has patched CVE-2026-102827 in the simple-git package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-77Command Injection
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published7 Nov 2026
Updated7 Nov 2026
First seen29 Sep 2026
Sources
CVE-2026-102827 · NVD
CVE-2026-102827 · MITRE
CVE-2026-102827 · OSV
GHSA-858h-whjf-mvg5 · GHSA
ROOT-APP-NPM-CVE-2026-102827 · OSV
Track software like this
Free during beta