CVE-2026-102827

A flaw was found in the simple-git Node.js library, which Red Hat ships as a bundled dependency in products such as grafana in Red Hat Enterprise Linux. The library's default blockUnsafeOperationsPlugin security filter compares parsed option names against the literal spellings of dangerous git options, but git accepts unambiguous long-option abbreviations. An attacker who can influence the command arguments an application passes to simple-git can therefore use abbreviated forms such as --receive-p or --exe (for --receive-pack or --exec) to bypass the filter on the git push path and cause git to invoke an attacker-selected command, resulting in arbitrary command execution on the host. The flaw only manifests in applications that process untrusted input and pass attacker-controlled arguments to simple-git git operations. Red Hat rates this flaw as IMPORTANT with a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while NIST rates it CRITICAL with 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the difference reflects Red Hat's assessment that exploitation depends on an application exposing attacker-influenced arguments to simple-git, which increases real-world attack complexity. Within Red Hat's product portfolio the affectedness varies by code path: for example, grafana-pcp in Red Hat Enterprise Linux is not affected because the vulnerable code is not in the execute path, and grafana streams in which the vulnerable code is not present are not affected. For affected Red Hat products the consequence is arbitrary command execution, and fixes are being pursued through the respective affected components.