{"action":"Upgrade simple-git to 3.32.0 or later.","affected":[{"fixed":"3.32.0","introduced":"0"}],"component":"simple-git","cve_ids":["CVE-2026-28291"],"ecosystem":"npm","epss":0.00768,"exploited":false,"fixed_versions":["3.32.0"],"ghsa_id":"GHSA-jcxm-m3jx-f287","id":"tcs_01M5KFXQQ613J4V5MT58CF263P","modified_at":"2026-09-10T03:50:44.599718778Z","published_at":"2026-04-13T16:35:37Z","references":["https://osv.dev/vulnerability/GHSA-jcxm-m3jx-f287","https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287","https://nvd.nist.gov/vuln/detail/CVE-2026-28291","https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d","https://github.com/steveukx/git-js","https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26","https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0","https://www.cve.org/CVERecord?id=CVE-2022-25860"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-jcxm-m3jx-f287","url":"https://osv.dev/vulnerability/GHSA-jcxm-m3jx-f287"}],"summary":"simple-git Affected by Command Execution via Option-Parsing Bypass"}