{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asimple_gitsimple_git/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:simple_git:simple_git:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-102828"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["simple-git (3.15.0 - 4.0.0)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","vulnerability","remote-code-execution"],"_cs_type":"threat","_cs_vendors":["simple-git"],"content_html":"\u003cp\u003eThe \u003ccode\u003esimple-git\u003c/code\u003e library (versions 3.15.0 through 3.36.0) contains a vulnerability in its \u003ccode\u003eblockUnsafeOperationsPlugin\u003c/code\u003e that fails to classify \u003ccode\u003etrailer.\u0026lt;token\u0026gt;.cmd\u003c/code\u003e as a dangerous Git configuration option. Git supports trailer commands to dynamically generate or modify metadata during operations like \u003ccode\u003egit interpret-trailers\u003c/code\u003e. Because \u003ccode\u003esimple-git\u003c/code\u003e does not include this key in its \u003ccode\u003epreventUnsafeConfig\u003c/code\u003e blocklist, an application that allows untrusted user input to influence Git configuration (e.g., via \u003ccode\u003eSimpleGitOptions.config\u003c/code\u003e or inline \u003ccode\u003e-c\u003c/code\u003e arguments) can be coerced into executing arbitrary shell commands. When the \u003ccode\u003egit\u003c/code\u003e binary is invoked with these attacker-controlled trailers, it executes the specified command with the permissions and environment of the Node.js process. This affects applications that bridge user-supplied data to \u003ccode\u003esimple-git\u003c/code\u003e configuration parameters without strict validation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an application endpoint or input field that passes user-controlled strings into \u003ccode\u003esimple-git\u003c/code\u003e configuration parameters.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious configuration payload: \u003ccode\u003etrailer.exploit.cmd=\u0026lt;malicious_command\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Node.js application accepts the input and initializes \u003ccode\u003esimple-git\u003c/code\u003e with the tainted configuration.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003esimple-git\u003c/code\u003e's \u003ccode\u003ecommandConfigPrefixingPlugin\u003c/code\u003e processes the configuration, converting it to \u003ccode\u003e-c trailer.exploit.cmd=\u0026lt;malicious_command\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eblockUnsafeOperationsPlugin\u003c/code\u003e evaluates the arguments; it ignores \u003ccode\u003etrailer.*.cmd\u003c/code\u003e keys as they are missing from the \u003ccode\u003epreventUnsafeConfig\u003c/code\u003e list.\u003c/li\u003e\n\u003cli\u003eThe application executes a Git command (e.g., \u003ccode\u003egit interpret-trailers\u003c/code\u003e) with the injected configuration.\u003c/li\u003e\n\u003cli\u003eThe underlying Git binary executes the attacker-supplied shell command as the Node.js process.\u003c/li\u003e\n\u003cli\u003eAttacker achieves remote code execution within the context of the application service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary command execution on the host running the Node.js application. The impact is limited only by the filesystem, network, and service permissions of the application process. Potential outcomes include exfiltration of local sensitive files, lateral movement within the environment, or full system compromise if the service runs with elevated privileges.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate audit of all code paths that utilize \u003ccode\u003esimple-git\u003c/code\u003e and pass user-supplied data into the \u003ccode\u003econfig\u003c/code\u003e object or command arguments.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003esimple-git\u003c/code\u003e to version 4.0.1 or later once available, as this release remediates the missing matcher.\u003c/li\u003e\n\u003cli\u003eImplement an explicit allowlist for Git configuration keys instead of relying solely on the default \u003ccode\u003eblockUnsafeOperationsPlugin\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eEnsure any application-level sanitization logic prevents the injection of \u003ccode\u003etrailer.*.cmd\u003c/code\u003e and \u003ccode\u003etrailer.*.command\u003c/code\u003e keys into \u003ccode\u003esimple-git\u003c/code\u003e configuration objects.\u003c/li\u003e\n\u003cli\u003eDeploy runtime monitoring for unexpected child processes spawned by Node.js applications that utilize Git, specifically looking for \u003ccode\u003egit\u003c/code\u003e spawning unexpected shell commands.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-06T00:42:03Z","date_published":"2026-10-06T00:42:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-simple-git-vulnerability/","summary":"The simple-git library fails to block 'trailer.\u003ctoken\u003e.cmd' configuration in its unsafe-operation guard, enabling command injection when applications process untrusted user input.","title":"Remote Code Execution via simple-git trailer.cmd Configuration","url":"https://feed.craftedsignal.io/briefs/2026-10-simple-git-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:simple_git:simple_git:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}