CVE-2026-102829
Description
A flaw was found in simple-git. The software fails to include the VISUAL environment variable in its unsafe editor detection checks. If a consuming application accepts untrusted environment variables, an attacker can specify a malicious program that Git launches during interactive operations, leading to arbitrary code execution with the privileges of the Node.js process.
Statement
An Important severity flaw was found in simple-git, which is used by the grafana component in Red Hat Enterprise Linux 8. The @simple-git/argv-parser package used by simple-git omits the VISUAL environment variable from its unsafe-editor detection: VISUAL is missing from GitEnvKeys, so the parser drops the value before it can be classified as allowUnsafeEditor. If a consuming application forwards attacker-influenced environment variables into the environment passed to Git child processes, an attacker can supply a VISUAL value that Git uses to launch an attacker-selected editor during operations that open an editor, such as commit amendment or interactive rebase, resulting in arbitrary code execution with the privileges of the Node.js process. Exploitation requires several preconditions: the consuming application must forward attacker-influenced environment values to Git, the Git operation must open an editor, no higher-priority editor setting (GIT_EDITOR, core.editor, or EDITOR) may override VISUAL, and Git's terminal prerequisites must be met. For this reason Red Hat rates this flaw Important (CVSS 8.1, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the upstream CVE record assigns a Critical score (CVSS 9.2) that does not account for the high attack complexity of the required application data flow. Among Red Hat products, grafana in Red Hat Enterprise Linux 8 (the 8.4 and 8.6 update streams) is affected and a fix is being pursued; grafana and grafana-pcp in Red Hat Enterprise Linux 8.10, 9, and 10 and in Red Hat In-Vehicle OS 2 are not affected because the vulnerable component is not present. Affectedness of other Red Hat products is still under assessment.
Mitigation
Applications using simple-git can mitigate this issue by ensuring that untrusted or attacker-influenced environment values are not forwarded into the environment passed to Git child processes (for example, via simple-git's .env()), and by explicitly setting a trusted editor using GIT_EDITOR or the Git core.editor configuration, which take precedence over VISUAL. The unsafe-editor guard already blocks EDITOR, GIT_EDITOR, and GIT_SEQUENCE_EDITOR values unless allowUnsafeEditor is explicitly enabled. The upstream project fixed this issue in @simple-git/argv-parser 2.0.1; Red Hat will deliver fixes for affected products through their update streams as they become available.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
