CVE-2026-102828

A flaw was found in simple-git. The default security filter designed to block unsafe Git operations does not prevent trailer command configurations from being set. If an application passes untrusted user input into Git configuration options, an attacker can exploit this flaw to achieve arbitrary code execution. Injected commands run with the operating-system privileges of the underlying Node.js process.

A flaw was found in simple-git, a Node.js interface for running Git commands, and is rated IMPORTANT by Red Hat Product Security. It affects Red Hat products that bundle a vulnerable version of the library, including the grafana component in Red Hat Enterprise Linux 10.0 and 9.6, Red Hat Build of Keycloak, and Konflux. The library's default blockUnsafeOperationsPlugin, which is designed to block unsafe Git configuration, does not classify trailer.<token>.cmd as unsafe configuration. If an application passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments, Git invokes an attacker-selected shell command when git interpret-trailers processes the configured trailer, resulting in arbitrary command execution with the operating-system identity and permissions of the Node.js process. Exploitation requires the application to pass untrusted input into Git configuration options, which is why Red Hat rates this flaw IMPORTANT rather than the CRITICAL severity assigned upstream. Other Red Hat product streams, including RHEL 8, the remaining RHEL 9 and RHEL 10 grafana and grafana-pcp builds, and the JBoss EAP maven repositories, are not affected because the vulnerable code is not present or not in the execution path. Fixes for the affected products are being pursued by the responsible product teams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications using simple-git can mitigate this issue by validating or restricting values passed into Git configuration options, and by not passing untrusted or user-controlled data into SimpleGitOptions.config or inline -c arguments. Applications that do not expose untrusted configuration or command arguments to simple-git are outside the threat model of this flaw. This issue is fixed upstream in simple-git 4.0.1; updates for affected Red Hat products will be delivered through their respective update channels as they become available.