Simple-Git Project Simple-Git
10 CVEs affecting Simple-Git Project Simple-Git. Latest disclosed: 2026-09-29. Critical: 3, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-102828 | Critical | 9.8 | 2026-09-29 | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until… |
CVE-2026-6951 | Critical | 9.8 | 2026-04-25 | Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.s… |
CVE-2026-28292 | Critical | 9.8 | 2026-03-10 | `simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypas… |
CVE-2026-102827 | High | 8.1 | 2026-09-29 | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, t… |
CVE-2026-102826 | High | 8.1 | 2026-09-29 | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, t… |
CVE-2026-28291 | High | 8.1 | 2026-04-13 | simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option ma… |
CVE-2022-25860 | High | 8.1 | 2023-01-26 | Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to… |
CVE-2022-25912 | High | 8.1 | 2022-12-06 | The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clo… |
CVE-2022-24066 | High | 8.1 | 2022-04-01 | The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMP… |
CVE-2022-24433 | High | 8.1 | 2022-03-11 | The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, bo… |