8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28291

CVE-2026-28291: simple-git has Command Execution via Option-Parsing Bypass

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28291

CVE-2026-28291:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
simple-git	npm	< 3.32.0	3.32.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a command injection bypass in the simple-git library. The root cause is an inadequate regular expression in the preventUploadPack function located in simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts. This function is intended to block unsafe git options, such as --upload-pack or its shorthand -u, which can be used to execute arbitrary commands. The vulnerable version of the code used the regex /^\\s*-u\\b/ to detect the -u option for the clone command. This check is easily bypassed because git allows for the combination of single-letter options. For example, an attacker could pass '-vu' where v stands for verbose and u for upload-pack. The regex would fail to match, allowing the unsafe option to be passed to the underlying git executable, resulting in remote command execution. The fixing commit 1effd8e5012a5da05a9776512fac3e39b11f2d2d replaces this flawed regex with a more robust check (isCloneSwitch('u', arg)) that correctly identifies the presence of the u character within a block of clone options, thus mitigating the vulnerability.

Vulnerable functions

preventUploadPack

simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts

The vulnerability lies in the `preventUploadPack` function, which was responsible for blocking potentially dangerous options. The regular expression `/^\\s*-u\\b/` used to detect the unsafe `-u` option for the `clone` command was insufficient. It only checked for `-u` as a standalone option. Git's command-line parser allows single-character options to be combined (e.g., `-v` and `-u` become `-vu`). An attacker could bypass the check by providing a combined option like `-vu`, which would not be caught by the regex, thus allowing the execution of an arbitrary command specified via the `-u` option.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.