CVE-2026-102827

A flaw was found in simple-git. This vulnerability allows an attacker who can influence command arguments to achieve arbitrary command execution on the host system. The library's security filter checks for dangerous options using exact names but fails to account for Git accepting abbreviated command options. Consequently, an attacker can supply abbreviated push options to bypass validation checks and execute arbitrary commands in applications that process untrusted input.

A flaw was found in the simple-git Node.js library, which Red Hat ships as a bundled dependency in products such as grafana in Red Hat Enterprise Linux. The library's default blockUnsafeOperationsPlugin security filter compares parsed option names against the literal spellings of dangerous git options, but git accepts unambiguous long-option abbreviations. An attacker who can influence the command arguments an application passes to simple-git can therefore use abbreviated forms such as --receive-p or --exe (for --receive-pack or --exec) to bypass the filter on the git push path and cause git to invoke an attacker-selected command, resulting in arbitrary command execution on the host. The flaw only manifests in applications that process untrusted input and pass attacker-controlled arguments to simple-git git operations. Red Hat rates this flaw as IMPORTANT with a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while NIST rates it CRITICAL with 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the difference reflects Red Hat's assessment that exploitation depends on an application exposing attacker-influenced arguments to simple-git, which increases real-world attack complexity. Within Red Hat's product portfolio the affectedness varies by code path: for example, grafana-pcp in Red Hat Enterprise Linux is not affected because the vulnerable code is not in the execute path, and grafana streams in which the vulnerable code is not present are not affected. For affected Red Hat products the consequence is arbitrary command execution, and fixes are being pursued through the respective affected components.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream project has fixed this issue in simple-git 4.0.0, so updating an affected application's bundled simple-git dependency to 4.0.0 or later addresses the issue.