CVE-2026-28292: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28292 is a critical OS command injection vulnerability in the simple-git npm package (Node.js interface for running git commands) that allows unauthenticated remote attackers to execute arbitrary OS commands on the host machine. It affects simple-git versions 3.15.0 through 3.32.2 and represents a bypass of two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912). The vulnerability was disclosed on March 10, 2026, with the official advisory published to the GitHub Advisory Database. It carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory, GitHub Security Advisory).

The root cause is a case-sensitive regular expression in the preventProtocolOverride function within simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts (CWE-78, CWE-178). The regex /^\s*protocol(.[a-z]+)?.allow/ was introduced to block the CVE-2022-25912 attack vector, but because it lacks the /i (case-insensitive) flag, it fails to match uppercase or mixed-case variants such as PROTOCOL.ALLOW=always or Protocol.Allow=always. Git itself normalizes config key names to lowercase internally, so passing -c PROTOCOL.ALLOW=always via the customArgs parameter of methods like clone(), fetch(), pull(), or push() enables the ext:: git protocol — which executes an arbitrary binary as a remote helper — without triggering the safety check. The fix is a single-character change: adding the /i flag to the regex (Github Advisory, Patch Commit).

Successful exploitation grants an unauthenticated network attacker full read, write, and execution access on the host machine as the process user running the Node.js application. This enables arbitrary OS command execution, data exfiltration, file system modification, deployment of backdoors or malware, and potential lateral movement within the host environment. Any application that passes user-controlled values into customArgs of simple-git methods is affected, making the blast radius dependent on the privilege level of the Node.js process and the sensitivity of data accessible to it (Github Advisory, GitHub Security Advisory).

A public proof-of-concept (PoC) is included in the GitHub Advisory and was authored by CodeAnt AI Security Research, demonstrating confirmed RCE via the uppercase bypass vector on simple-git 3.32.2 with Node.js v23.11.0 and git 2.39.5. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.138–0.146%, placing it in the 35th percentile for exploitation probability within 30 days. Nessus detection plugins (IDs 301850 and 303488) are available (Github Advisory, Feedly).

1. Identify a vulnerable target: Find a web application or service that uses simple-git versions 3.15.0–3.32.2 and passes user-controlled input into the customArgs parameter of methods such as clone(), fetch(), pull(), or push().
2. Craft the bypass payload: Prepare a -c argument using an uppercase or mixed-case variant of the protocol.allow config key (e.g., -c PROTOCOL.ALLOW=always) to bypass the case-sensitive regex check in preventProtocolOverride.
3. Inject a malicious ext:: URL: Supply an ext:: protocol URL as the repository URL, embedding a shell command. Example: ext::sh -c touch% /tmp/pwned% >&2.
4. Submit the payload: Trigger the vulnerable git operation (e.g., via an API endpoint that accepts a repository URL and custom arguments), passing both the uppercase PROTOCOL.ALLOW=always argument and the malicious ext:: URL.
5. Achieve RCE: Git normalizes the config key to lowercase internally, enables the ext:: protocol, and executes the injected shell command as the Node.js process user before returning an error about the missing repository — confirming arbitrary command execution on the host (Github Advisory, GitHub Security Advisory).

• Process: Unexpected child processes spawned by the Node.js process running simple-git (e.g., sh, bash, curl, wget, python) with unusual arguments or working directories.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the Node.js process user; new cron jobs, SSH authorized keys, or scripts added by the application service account.
• Logs: Application logs showing git operations invoked with -c PROTOCOL.ALLOW=always, PROTOCOL.allow=always, Protocol.Allow=always, or other mixed-case variants of protocol.allow; git error messages referencing ext:: protocol or remote helper execution failures.
• Network: Unexpected outbound connections from the Node.js server process to unknown external IPs or domains, particularly following git operation calls; DNS lookups for attacker-controlled infrastructure initiated by the server process.
• Network: Git subprocess initiating connections to non-standard remote endpoints or executing commands that generate outbound traffic (e.g., reverse shells) (Github Advisory).

Upgrade simple-git to version 3.32.3 or later, which adds the /i flag to the preventProtocolOverride regex, making the check case-insensitive and blocking all variants of the protocol.allow bypass. IBM DevOps Solution Workbench users should apply the security updates detailed in IBM's advisory. As an interim workaround, validate and sanitize all user-controlled inputs before passing them to any simple-git method, and avoid exposing customArgs to untrusted user input. Additionally, review and restrict the use of protocol.allow=always configuration in your environment if not strictly required (Github Advisory, IBM Advisory, Patch Commit).

The vulnerability attracted notable community attention, with discussion threads appearing on Reddit (r/netsec and r/programminghumor), Hacker News, and Mastodon/infosec.exchange shortly after disclosure. The r/programminghumor thread highlighted the irony of a package with 12 million weekly npm installs being vulnerable due to a missing /i regex flag. Security researchers on dev.to and Medium published write-ups explaining how a single case-sensitivity oversight bypassed two prior CVE patches. CodeAnt AI Security Research, who discovered and reported the issue, published a detailed technical analysis. IBM issued a security bulletin for affected DevOps Solution Workbench products, and openSUSE published a security announcement for downstream package updates (Github Advisory, IBM Advisory).