Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-28292: simple-git may let attackers run code

CVE-2026-28292 · published 1 day ago

Summary

The simple-git tool used in several projects had a security weakness that could let an attacker run unwanted code on your system. Updated versions of simple-git have been released that correct this problem. Install the newest version of simple-git as soon as possible to stay protected.

What to do

Update GitHub Actions simple-git to version 3.32.3.
Update simple-git to version 3.30.0-aikido.4.
Update rootio @rootio/simple-git to version 3.30.0-root.io.4.
Update simple-git to version 3.28.0-aikido.4.
Update rootio @rootio/simple-git to version 3.28.0-root.io.4.
Update simple-git to version 3.28.0-aikido.5.
Update rootio @rootio/simple-git to version 3.28.0-root.io.5.
Update simple-git to version 3.28.0-aikido.6.
Update rootio @rootio/simple-git to version 3.28.0-root.io.6.
Update simple-git to version 3.27.0-aikido.5.
Update rootio @rootio/simple-git to version 3.27.0-root.io.5.
Update simple-git to version 3.30.0-aikido.7.
Update rootio @rootio/simple-git to version 3.30.0-root.io.7.
Update simple-git_project simple-git to version 3.32.2 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	GitHub Actions	simple-git	>= 3.15.0, < 3.32.3 Fix: upgrade to 3.32.3
–	simple-git_project	simple-git	>= 3.15.0, < 3.32.2 `cpe:2.3:a:simple-git_project:simple-git::::::node.js::*`
–	steveukx	simple-git	>= 3.15.0, < 3.32.3
Root:npm	–	simple-git	< 3.30.0-aikido.4 < 3.28.0-aikido.4 < 3.28.0-aikido.5 < 3.28.0-aikido.6 < 3.27.0-aikido.5 < 3.30.0-aikido.7 Fix: upgrade to 3.30.0-aikido.4
Root:npm	rootio	@rootio/simple-git	< 3.30.0-root.io.4 < 3.28.0-root.io.4 < 3.28.0-root.io.5 < 3.28.0-root.io.6 < 3.27.0-root.io.5 < 3.30.0-root.io.7 Fix: upgrade to 3.30.0-root.io.4

Original advisory text

CVE-2026-28292 in simple-git - Patched by Root

Root has patched CVE-2026-28292 in the simple-git package for Root:npm. Multiple fixed versions available.

References

https://github.com/advisories/GHSA-r275-fr43-pm7q
https://github.com/steveukx/git-js Product
https://www.codeant.ai/security-research/security-research-simple-git-remote-cod... URL
https://github.com/steveukx/git-js/commit/f7042088aa2dac59e3c49a84d7a2f4b26048a2... Patch
https://github.com/steveukx/git-js/security/advisories/GHSA-r275-fr43-pm7q Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-28292 Vendor Advisory
https://www.codeant.ai/security-research/simple-git-remote-code-execution-cve-20... Exploit
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28292.json URL
https://access.redhat.com/security/cve/CVE-2026-28292 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28292... Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2446162 Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-78OS Command Injection

CWE-178Improper Handling of Case Sensitivity

CWE-76Improper Neutralization of Equivalent Special Elements

Timeline

Published6 Nov 2026

Updated6 Nov 2026

First seen10 Mar 2026

Sources

CVE-2026-28292 · NVD

GHSA-r275-fr43-pm7q · GHSA

GHSA-r275-fr43-pm7q · OSV

CVE-2026-28292 · MITRE

ROOT-APP-NPM-CVE-2026-28292 · OSV

CVE-2026-28292 · OSV

Track software like this

Free during beta