Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-6951: simple-git may allow unauthorized code execution

CVE-2026-6951 · published today

Summary

The simple-git library used in several projects can be exploited to run unauthorized code. Updated versions of the library have been released that close this gap. Upgrade to the latest simple-git package as soon as possible to protect your systems.

What to do

Update GitHub Actions simple-git to version 3.36.0.
Update simple-git to version 3.36.0-aikido.1.
Update rootio @rootio/simple-git to version 3.36.0-root.io.1.
Update simple-git to version 3.36.0-aikido.2.
Update rootio @rootio/simple-git to version 3.36.0-root.io.2.
Update simple-git to version 3.36.0-aikido.3.
Update rootio @rootio/simple-git to version 3.36.0-root.io.3.
Update simple-git_project simple-git to version 3.36.0 or later.
Update org.webjars.npm:simple-git to version * or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	GitHub Actions	simple-git	< 3.36.0 Fix: upgrade to 3.36.0
–	simple-git_project	simple-git	>= 3.15.0, < 3.36.0 `cpe:2.3:a:simple-git_project:simple-git::::::node.js::*`
–	–	org.webjars.npm:simple-git	< *
Root:npm	–	simple-git	< 3.36.0-aikido.1 < 3.36.0-aikido.2 < 3.36.0-aikido.3 Fix: upgrade to 3.36.0-aikido.1
Root:npm	rootio	@rootio/simple-git	< 3.36.0-root.io.1 < 3.36.0-root.io.2 < 3.36.0-root.io.3 Fix: upgrade to 3.36.0-root.io.1

Original advisory text

CVE-2026-6951 in simple-git - Patched by Root

Root has patched CVE-2026-6951 in the simple-git package for Root:npm. Multiple fixed versions available.

References

https://github.com/advisories/GHSA-hffm-xvc3-vprc
https://github.com/steveukx/git-js Product
https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6 URL
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16300211 URL
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6951.json URL
https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078 URL
https://access.redhat.com/security/cve/CVE-2026-6951 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6951.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6951 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2461750 Third Party Advisory
https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746... Patch

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-94Code Injection

CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Timeline

Published7 Nov 2026

Updated7 Nov 2026

First seen25 Apr 2026

Sources

CVE-2026-6951 · NVD

GHSA-hffm-xvc3-vprc · GHSA

GHSA-hffm-xvc3-vprc · OSV

CVE-2026-6951 · MITRE

CVE-2026-6951 · OSV

ROOT-APP-NPM-CVE-2026-6951 · OSV

Track software like this

Free during beta