CVE-2026-28291

OVERVIEW CVE-2026-28291 is a command injection vulnerability in simple-git versions up to 3.31.1, a JavaScript library that executes native Git commands. The vulnerability allows attackers to bypass security controls designed to prevent execution of dangerous Git options like -u and --upload-pack through option manipulation. The flaw represents an incomplete remediation of CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations to circumvent the regex-based blocklist. The issue has been patched in version 3.32.0. SEVERITY The vulnerability carries a CVSS score of 8.1 (HIGH) with a network-based attack vector requiring no user interaction but moderate attack complexity. Exploitation could result in high-impact consequences including confidentiality breach, integrity compromise, and availability disruption. The root cause stems from Git's parsing behavior, which accepts virtually infinite valid option variants, making complete blocklist-based mitigation impractical without fully emulating Git's parsing logic. This architectural limitation suggests the risk could persist if incomplete mitigations are applied. EXPLOITATION STATUS There is no indication of active exploitation, with no confirmed entries on the Known Exploited Vulnerabilities catalog. The EPSS score of 0.00125 reflects minimal probability of exploitation in the wild relative to other CVEs. No public exploit code availability has been reported, and community attention appears limited. Organizations running simple-git should prioritize upgrading to version 3.32.0 to remediate this high-severity command injection risk.