CVE-2026-28291: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28291 is a command execution vulnerability via option-parsing bypass in the simple-git npm package, which enables running native Git commands from JavaScript. The flaw allows a malicious actor who can control the options passed to simple-git functions to execute arbitrary OS commands even when the library is in its default "safe" state (i.e., allowUnsafePack is not explicitly enabled). It affects all versions of simple-git prior to 3.32.0 (confirmed vulnerable through 3.28.0) and was disclosed on April 12–13, 2026. IBM DevOps Solution Workbench is also listed as an affected product. The CVSS v3.1 base score is 8.1 (High) (Github Advisory, Feedly).

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection). It was introduced by an incomplete patch for the prior vulnerability CVE-2022-25860, which added a blocklist in block-unsafe-operations-plugin.ts to prevent use of -u and --upload-pack options during git clone. The fix used the regex /^\s*-u\b/ to detect the -u flag, but Git's option parser is flexible enough to accept combined short options (e.g., -vu, -nu, -4u, -lu) that embed -u alongside other characters, bypassing the regex check entirely. An attacker who can supply options to a simple-git function call (e.g., git.clone()) can inject a crafted option string such as -vu sh -c "touch /tmp/pwned" to cause Git to execute an arbitrary shell command with the privileges of the Node.js process. The vulnerability was confirmed on Linux environments (WSL/Docker with Node v22.19.0 and git 2.39.5) and was not reproduced on Windows 11 (Github Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary system commands with the privileges of the Node.js process running simple-git, resulting in high impact to confidentiality, integrity, and availability. An attacker could read sensitive files, modify or delete data, install backdoors, or pivot to other systems accessible from the compromised host. The attack requires the ability to control options passed to simple-git API calls, which is most relevant in applications that accept user-supplied input and pass it to simple-git without sanitization (Github Advisory, Feedly).

A public proof-of-concept (PoC) is available in the GitHub Security Advisory, demonstrating command execution via crafted option strings such as -vu sh -c "touch /tmp/pwned" passed to git.clone(). The PoC was authored by the reporter JuHwiSang and confirmed to work on Linux with simple-git 3.28.0. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.125% (Feedly data) to 0.156% (GitHub Advisory), placing it in the lower-to-mid percentile for exploitation likelihood. The vulnerability is not currently listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Identify a vulnerable target: Find a Node.js application using simple-git versions prior to 3.32.0 on a Linux host where user-controlled input can influence options passed to simple-git API calls (e.g., git.clone()).
2. Craft a bypass option string: Construct a combined short-option argument that embeds -u alongside another valid Git short option character to bypass the blocklist regex. Known working examples include -vu, -nu, -qu, -su, -lu, -4u, -6u.
3. Inject the payload: Supply the crafted option and a shell command as the next argument. For example:

   const { simpleGit } = require('simple-git');
   const git = simpleGit({ unsafe: { allowUnsafePack: false } });
   await git.clone('./testrepo1', './testrepo2', ['-vu', 'sh -c "touch /tmp/pwned"']);

4. Achieve command execution: Git's option parser interprets the combined flag as including -u, treating the next argument as the upload-pack command to execute. The shell command runs with the privileges of the Node.js process.
5. Verify execution: Confirm that the injected command executed (e.g., check for the existence of /tmp/pwned or observe other side effects of the payload) (Github Advisory).

• Process: Unexpected child processes spawned by the Node.js process running simple-git, such as sh, bash, curl, wget, or other shell utilities not normally invoked during Git operations.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) or application directories; new cron jobs, scripts, or web shells created by the Node.js service account.
• Logs: Application logs showing errors or exceptions from simple-git related to git clone or git push operations with unusual option strings containing combined short flags (e.g., -vu, -nu, -4u); Node.js process logs showing unexpected spawn calls.
• Network: Outbound connections from the Node.js server to unexpected external IPs or domains, potentially indicating reverse shell or data exfiltration activity following successful command injection (Github Advisory).

The primary remediation is to upgrade simple-git to version 3.32.0 or later, which enhances the unsafe plugin to block additional disguised forms of the -u switch using an improved regex pattern (/^\0*(-|--|--no-)[\0\dlsqvnobucj]+/) (Release Notes, Patch Commit). IBM DevOps Solution Workbench users should apply the security updates referenced in IBM's advisory (IBM Advisory). As a defense-in-depth measure, applications should validate and sanitize all user-supplied input before passing it as options to simple-git functions, and run Node.js processes with the least privileges necessary to limit the impact of any successful exploitation.

The vulnerability was reported by security researcher JuHwiSang, who noted in the advisory that the root cause is fundamentally difficult to fully remediate because Git's option parsing rules are complex and the number of option variants that can enable command execution may be effectively infinite. The researcher expressed skepticism that a complete blocklist-based fix is feasible, suggesting that faithfully emulating Git's option parsing would be required. The advisory was published by the maintainer (steveukx) on April 12, 2026, and the fix was released promptly in simple-git 3.32.0 (Github Advisory, Release Notes).