Critical 9.8Published Mar 10, 2026

CVE-2026-28292simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE

Updated under an hour ago (Oct 27, 2026, 9:23 AM ET)

Does this affect you?

It affects steveukx simple-git and 6 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for steveukx simple-git

Exploited in the last 30 days

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78, CWE-178, CWE-76
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Modified
Record last updated: Jul 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

steveukx simple-git steveukx:simple_git (from the name)	from 3.15.0, < 3.32.3	CNA record
Red Hat Logging Subsystem for Red Hat OpenShift redhat:logging	5	CISA ADP
Red Hat Red Hat Enterprise Linux 8 redhat:enterprise_linux	8	CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform 8 redhat:jboss_enterprise_application_platform	8	CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack redhat:jbosseapxp	Versions not stated	CISA ADP
Red Hat Red Hat Process Automation 7 redhat:jboss_enterprise_bpms_platform	7	CISA ADP
simple-git_project simple-git simple-git_project:simple-git	from 3.15.0 before 3.32.2	NVD

References

References

https://github.com/steveukx/git-js/security/advisories/GHSA-r275-fr43-pm7q	x-refsource-confirm
https://github.com/steveukx/git-js/commit/f7042088aa2dac59e3c49a84d7a2f4b26048a257	x-refsource-misc, patch
https://www.codeant.ai/security-research/security-research-simple-git-remote-code-execution-cve-2026-28292	x-refsource-misc, exploit, third-party-advisory
https://access.redhat.com/security/cve/CVE-2026-28292
https://bugzilla.redhat.com/show_bug.cgi?id=2446162
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28292.json
https://www.codeant.ai/security-research/simple-git-remote-code-execution-cve-2026-28292

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.