{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asimple-git_projectsimple-git/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:simple-git_project:simple-git:*:*:*:*:*:*:*:*","cpe:2.3:a:simple-git_project:simple-git:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-6951"},{"cvss":8.1,"id":"CVE-2022-25912"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["simple-git (\u003c 3.36.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2026-6951 describes a remote code execution (RCE) vulnerability in the simple-git library (versions prior to 3.36.0) caused by an incomplete patch for CVE-2022-25912. While previous mitigations successfully restricted the use of the -c flag in Git arguments, the --config equivalent remained improperly sanitized. An attacker who can control Git arguments passed to simple-git can leverage this deficiency to enable the Git 'ext' protocol. This allows for the execution of arbitrary system commands through a specially crafted repository URL string. Because simple-git is frequently used in Node.js applications to manage version control, successful exploitation results in RCE with the privileges of the Node.js runtime process. This vulnerability is highly critical as it permits attackers to gain reverse shells, exfiltrate sensitive files, or manipulate application data.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a web application or internal service that utilizes simple-git to perform repository operations (e.g., import or clone).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious repository string utilizing the 'ext::' prefix to trigger arbitrary command execution.\u003c/li\u003e\n\u003cli\u003eAttacker injects the '--config' argument and 'protocol.ext.allow=always' setting into the target application's Git options, bypassing previous input filters.\u003c/li\u003e\n\u003cli\u003eThe victim application invokes simple-git, passing the untrusted inputs directly to the underlying Git binary.\u003c/li\u003e\n\u003cli\u003eThe Git binary parses the '--config' argument, enabling the dangerous 'ext' protocol for the current execution context.\u003c/li\u003e\n\u003cli\u003eThe Git process executes the command specified in the 'ext::' prefix (e.g., 'sh -c id').\u003c/li\u003e\n\u003cli\u003eArbitrary code executes in the context of the Node.js application process, leading to full system compromise or persistence.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthenticated remote code execution with the privileges of the underlying Node.js application. Potential impacts include full system compromise, exfiltration of application source code or environment variables, modification of critical data, and deployment of secondary payloads such as reverse shells. The vulnerability has been assigned a CVSS score of 9.8.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade simple-git to version 3.36.0 or later immediately to patch CVE-2026-6951.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation for all repository URLs and Git arguments accepted by the application, specifically blocking the 'ext::' protocol prefix.\u003c/li\u003e\n\u003cli\u003eRefactor application code to avoid passing user-controlled input directly into Git configuration flags like '--config' or '-c'.\u003c/li\u003e\n\u003cli\u003eAudit applications using simple-git to identify and restrict the passing of arbitrary array options to the library's command execution methods.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T14:48:31Z","date_published":"2026-10-14T14:48:31Z","id":"https://feed.craftedsignal.io/briefs/2026-10-simple-git-rce/","summary":"CVE-2026-6951 is a remote code execution vulnerability in the simple-git library, resulting from a filter bypass that allows command injection through the --config option and the Git ext protocol.","title":"Remote Code Execution in simple-git via --config Injection","url":"https://feed.craftedsignal.io/briefs/2026-10-simple-git-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:simple-Git_project:simple-Git:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}