Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-102829: simple-git may launch attacker-chosen editor
CVE-2026-102829 · published 11 days ago
Summary
The simple-git library and its argv-parser component can miss the VISUAL environment setting, allowing a malicious editor to be started when Git commands are run from a Node.js app. If an application passes untrusted environment values, the attacker‑chosen editor runs with the same rights as the Node.js process, potentially compromising the system. Update the argv-parser package to version 2.0.1 or later to fix the issue.
What to do
- Update simple-git argv-parser to version 2.0.1.
- Update simple-git @simple-git/argv-parser to version 2.0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | steveukx | git-js | < 2.0.1 |
| npm | simple-git | argv-parser |
< 2.0.1 Fix: upgrade to 2.0.1
|
| npm | simple-git | @simple-git/argv-parser |
< 2.0.1 Fix: upgrade to 2.0.1
|
Original advisory text
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it as allowUnsafeEditor. A consuming application that forwards attacker-influenced environment values can therefore allow Git to invoke an attacker-selected editor during operations such as commit amendment or interactive rebase when no higher-priority editor setting overrides VISUAL and Git's terminal prerequisites are met. The executable runs with the privileges of the Node.js process. This issue is fixed in argv-parser 2.0.1.
References
- https://github.com/steveukx/git-js/commit/68874c239f0c7a87f4a68c3d2c4a0d7c75bb27...
- https://github.com/steveukx/git-js/pull/1201
- https://github.com/steveukx/git-js/releases/tag/@simple-git/[email protected]
- https://github.com/steveukx/git-js/security/advisories/GHSA-v5rq-49vh-5v5c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1028... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102829 Vendor Advisory
- https://github.com/advisories/GHSA-v5rq-49vh-5v5c
- https://github.com/steveukx/git-js Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-78OS Command Injection
CWE-184Incomplete List of Disallowed Inputs
Timeline
Published29 Sep 2026
Updated9 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-102829 · NVD
CVE-2026-102829 · MITRE
CVE-2026-102829 · OSV
GHSA-v5rq-49vh-5v5c · GHSA
GHSA-v5rq-49vh-5v5c · OSV
Track software like this
Free during beta