CVE-2026-102826

Description

A flaw was found in simple-git. The library fails to properly sanitize Git configuration directives passed through custom clone arguments, which allows Git to load an attacker-controlled configuration file. By specifying executable settings within that configuration, an attacker can achieve arbitrary code execution with the privileges of the application process. Exploitation requires the host application to accept untrusted clone arguments and requires access to a readable, attacker-controlled file on the system.

Statement

An important-severity operating system command injection flaw affects Red Hat products that bundle the simple-git Node.js library, including Red Hat Enterprise Linux (grafana-pcp), Red Hat Build of Keycloak, Red Hat In-Vehicle OS, and Konflux (mintmaker-renovate-image). The default blockUnsafeOperationsPlugin in simple-git does not completely reject Git configuration include directives (include.path and includeIf..path) supplied through customArgs to git.clone(). If an application flows attacker-influenced data into these custom clone arguments, an attacker can direct Git to load an attacker-controlled configuration file; that configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation, resulting in arbitrary command execution with the privileges of the Node.js process. Exploitation requires the host application to pass untrusted clone arguments and requires the attacker to control a file readable by the process, so deployments that do not pass untrusted data into clone custom arguments are not exposed to this attack vector. Fixes are being pursued for the affected Red Hat products through the responsible engineering teams. Some product streams, including certain JBoss EAP maven repository artifacts and RHEL grafana-pcp builds, were determined not affected because the vulnerable component or vulnerable code is not present in those builds.

Mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score8.1N/A8.1
Attack VectorNetworkN/ANetwork
Attack ComplexityHighN/AHigh
Privileges RequiredNoneN/ANone
User InteractionNoneN/ANone
ScopeUnchangedN/AUnchanged
ConfidentialityHighN/AHigh
Integrity ImpactHighN/AHigh
Availability ImpactHighN/AHigh

Vector

Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Understanding the Weakness (CWE)

CWE-78

Confidentiality,Integrity,Availability,Non-Repudiation

Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities

Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.