CVE-2026-28291
1 advisory.
npm/simple-git CVE-2026-28291: high 8.1
simple-git Affected by Command Execution via Option-Parsing Bypass
Action: Upgrade simple-git to 3.32.0 or later.
npm i simple-git@3.32.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.32.0 | - |
Fixed versions
| 3.32.0 |
Sources
- osv: GHSA-jcxm-m3jx-f287
- https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287
- https://nvd.nist.gov/vuln/detail/CVE-2026-28291
- https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d
- https://github.com/steveukx/git-js
- https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26
- https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0
- https://www.cve.org/CVERecord?id=CVE-2022-25860
CVE-2026-28291 · published · modified · JSON