Attack Chain

1. Attacker identifies an application endpoint or input field that passes user-controlled strings into simple-git configuration parameters.
2. Attacker crafts a malicious configuration payload: trailer.exploit.cmd=<malicious_command>.
3. The Node.js application accepts the input and initializes simple-git with the tainted configuration.
4. simple-git's commandConfigPrefixingPlugin processes the configuration, converting it to -c trailer.exploit.cmd=<malicious_command>.
5. blockUnsafeOperationsPlugin evaluates the arguments; it ignores trailer.*.cmd keys as they are missing from the preventUnsafeConfig list.
6. The application executes a Git command (e.g., git interpret-trailers) with the injected configuration.
7. The underlying Git binary executes the attacker-supplied shell command as the Node.js process.
8. Attacker achieves remote code execution within the context of the application service.

Impact

Successful exploitation results in arbitrary command execution on the host running the Node.js application. The impact is limited only by the filesystem, network, and service permissions of the application process. Potential outcomes include exfiltration of local sensitive files, lateral movement within the environment, or full system compromise if the service runs with elevated privileges.

Recommendation

Prioritize the immediate audit of all code paths that utilize simple-git and pass user-supplied data into the config object or command arguments.

• Update simple-git to version 4.0.1 or later once available, as this release remediates the missing matcher.
• Implement an explicit allowlist for Git configuration keys instead of relying solely on the default blockUnsafeOperationsPlugin.
• Ensure any application-level sanitization logic prevents the injection of trailer.*.cmd and trailer.*.command keys into simple-git configuration objects.
• Deploy runtime monitoring for unexpected child processes spawned by Node.js applications that utilize Git, specifically looking for git spawning unexpected shell commands.

However, the parser's denylist implementation at packages/argv-parser/src/env/parse-env.ts fails to include the VISUAL environment variable. Furthermore, the prepareEnv function filters environment variables by checking if they exist in the GitEnvKeys map or start with the git prefix. Because VISUAL is neither in the map nor prefixed with git, it is discarded before the vulnerability scanner can evaluate it. Since Git falls back to VISUAL when resolving an editor, an attacker can supply a malicious binary path via this variable to gain code execution as the host user, bypassing the intended security guard.

Attack Chain

1. Attacker identifies a target application that uses @simple-git/argv-parser and allows user-controlled input to influence the environment variables passed to a spawned Git process.
2. Attacker crafts a malicious environment object containing VISUAL=/tmp/evileditor and a TERM variable (set to a value other than 'dumb').
3. Attacker triggers a Git operation that requires an editor, such as git commit --amend or git rebase -i.
4. The application passes the attacker-influenced environment to parseEnv for security validation.
5. prepareEnv drops the VISUAL key because it is not recognized as a known Git environment key or prefixed with 'git'.
6. The vulnerabilityCheck function returns an empty list, incorrectly signaling that the operation is safe.
7. The application executes the Git child process with the attacker's environment.
8. Git resolves the editor using the VISUAL variable, launching the attacker's binary against repository files (e.g., .git/COMMIT_EDITMSG) with the privileges of the host user.

Impact

The vulnerability allows an attacker to execute arbitrary binaries under the context of the user running the Git process. This leads to potential command execution, unauthorized modification of repository data, and potential lateral movement if the process runs in a privileged or CI/CD environment. The impact is dependent on the consuming application's data flow, specifically whether untrusted user input is allowed to modify the child process environment.

Recommendation

1. Patch the application by updating @simple-git/argv-parser once a fix is released by the maintainer.
2. Apply a temporary hotfix to packages/argv-parser/src/env/parse-env.ts by adding 'visual': 'allowUnsafeEditor' to the GitEnvKeys mapping.
3. Update docs/PLUGIN-UNSAFE-ACTIONS.md to reflect that VISUAL is now considered an unsafe editor variable.
4. Audit consuming applications to ensure that user-supplied input is not directly forwarded into the environment of child processes.
5. Consider explicitly setting a safe core.editor or GIT_EDITOR in the Git environment to override the VISUAL variable, effectively disabling the attacker's fallback.