CVE-2026-102828

Description

A flaw was found in simple-git. The default security filter designed to block unsafe Git operations does not prevent trailer command configurations from being set. If an application passes untrusted user input into Git configuration options, an attacker can exploit this flaw to achieve arbitrary code execution. Injected commands run with the operating-system privileges of the underlying Node.js process.

Statement

A flaw was found in simple-git, a Node.js interface for running Git commands, and is rated IMPORTANT by Red Hat Product Security. It affects Red Hat products that bundle a vulnerable version of the library, including the grafana component in Red Hat Enterprise Linux 10.0 and 9.6, Red Hat Build of Keycloak, and Konflux. The library's default blockUnsafeOperationsPlugin, which is designed to block unsafe Git configuration, does not classify trailer..cmd as unsafe configuration. If an application passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments, Git invokes an attacker-selected shell command when git interpret-trailers processes the configured trailer, resulting in arbitrary command execution with the operating-system identity and permissions of the Node.js process. Exploitation requires the application to pass untrusted input into Git configuration options, which is why Red Hat rates this flaw IMPORTANT rather than the CRITICAL severity assigned upstream. Other Red Hat product streams, including RHEL 8, the remaining RHEL 9 and RHEL 10 grafana and grafana-pcp builds, and the JBoss EAP maven repositories, are not affected because the vulnerable code is not present or not in the execution path. Fixes for the affected products are being pursued by the responsible product teams.

Mitigation

Applications using simple-git can mitigate this issue by validating or restricting values passed into Git configuration options, and by not passing untrusted or user-controlled data into SimpleGitOptions.config or inline -c arguments. Applications that do not expose untrusted configuration or command arguments to simple-git are outside the threat model of this flaw. This issue is fixed upstream in simple-git 4.0.1; updates for affected Red Hat products will be delivered through their respective update channels as they become available.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score8.19.8N/A
Attack VectorNetworkNetworkN/A
Attack ComplexityHighLowN/A
Privileges RequiredNoneNoneN/A
User InteractionNoneNoneN/A
ScopeUnchangedUnchangedN/A
ConfidentialityHighHighN/A
Integrity ImpactHighHighN/A
Availability ImpactHighHighN/A

Vector

Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Understanding the Weakness (CWE)

CWE-78

Confidentiality,Integrity,Availability,Non-Repudiation

Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities

Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.