Critical 9.8Published Apr 25, 2026

CVE-2026-6951Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) t…

Updated under an hour ago (Oct 27, 2026, 3:00 AM ET)

Does this affect you?

It affects Red Hat Enterprise Linux 8 and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Red Hat Enterprise Linux 8

Exploited in the last 30 days

Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Weakness (CWE): CWE-94, CWE-88
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: snyk
NVD analysis: Modified
Record last updated: Sep 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Red Hat Red Hat Enterprise Linux 8 redhat:enterprise_linux	8	CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform 8 redhat:jboss_enterprise_application_platform	8	CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack redhat:jbosseapxp	Versions not stated	CISA ADP
Red Hat Red Hat Process Automation 7 redhat:jboss_enterprise_bpms_platform	7	CISA ADP
simple-git_project simple-git simple-git_project:simple-git	from 3.15.0 before 3.36.0	NVD

References

References

https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078	exploit, third-party-advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16300211
https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6	exploit, third-party-advisory
https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8	patch
https://access.redhat.com/security/cve/CVE-2026-6951
https://bugzilla.redhat.com/show_bug.cgi?id=2461750
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6951.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.