by Kastro CVE-2026-28292
steveukx simple-git — simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE
Description · from the CVE record
`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.
Affected
ProductAffectedFixed inSource
simple-git>= 3.15.0, < 3.32.3–CNA
Logging Subsystem for Red Hat OpenShiftsee advisory–redhat-SADP
Logging Subsystem for Red Hat OpenShiftsee advisory–redhat-SADP
Logging Subsystem for Red Hat OpenShiftsee advisory–redhat-SADP
Logging Subsystem for Red Hat OpenShiftsee advisory–redhat-SADP
Logging Subsystem for Red Hat OpenShiftsee advisory–redhat-SADP
Logging Subsystem for Red Hat OpenShiftsee advisory–redhat-SADP
Red Hat Enterprise Linux 8see advisory–redhat-SADP
Red Hat Enterprise Linux 9see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform 8see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform Expansion Packsee advisory–redhat-SADP
Red Hat Process Automation 7see advisory–redhat-SADP
Scores by source
GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat-SADP (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total