simple-git command execution via Git config include path

A vulnerability in simple-git allows OS command injection through unblocked Git configuration includes in the `git.clone()` function. Attackers can execute arbitrary code by passing `-c include.path=<file>` via customArgs, with a pending fix that incompletely addresses conditional include variants.

Disclosed 5 October 2026 · Record updated 6 October 2026

Impact

Arbitrary OS command execution in applications using simple-git that pass attacker-controlled data to customArgs in git.clone()

Our coverage

A puppet master's strings slip through a hastily patched fence, revealing a second hidden gap where commands still whisper through unguarded doors.

Vulnerabilities

simple-git flaw lets crafted clone arguments run shell commands

A GitHub advisory published on 5 October 2026 says the npm package's safety denylist misses Git config includes, and the pending fix misses a variant.

6 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-g4wm-2vf7-vfgr