{"action":"Upgrade simple-git to 4.0.1 or later.","affected":[{"fixed":"4.0.1","introduced":"3.15.0"}],"component":"simple-git","cve_ids":["CVE-2026-102828"],"ecosystem":"npm","epss":0.0037,"exploited":false,"fixed_versions":["4.0.1"],"ghsa_id":"GHSA-x6jw-m9v5-85vh","id":"tcs_01M5KGH5Z6FPPXN8EVEPV6Q43H","modified_at":"2026-10-06T00:00:09.444607978Z","published_at":"2026-10-05T23:48:14Z","references":["https://osv.dev/vulnerability/GHSA-x6jw-m9v5-85vh","https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh","https://nvd.nist.gov/vuln/detail/CVE-2026-102828","https://github.com/steveukx/git-js/pull/1198","https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3","https://github.com/steveukx/git-js","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.1"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-x6jw-m9v5-85vh","url":"https://osv.dev/vulnerability/GHSA-x6jw-m9v5-85vh"},{"source":"nvd","source_id":"CVE-2026-102828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102828"}],"summary":"simple-git unsafe-operation guard does not block trailer command configuration"}