simple-git flaw lets crafted clone arguments run shell commands

A security advisory published on 5 October 2026 describes an OS command injection vulnerability in simple-git, the widely used npm library that wraps the Git command line. Tracked as CVE-2026-102826 under GitHub advisory GHSA-g4wm-2vf7-vfgr, the flaw affects applications that pass attacker-influenced data into the customArgs option of git.clone(). According to the advisory, an attacker who can do that can run arbitrary commands in the context of the process using simple-git.

The issue sits in simple-git's blockUnsafeOperationsPlugin, a feature that is meant to block dangerous Git configuration writes. The advisory says version 3.36.0, the current latest release on npm at the time of publication, ships with no include.path entry in that denylist. Git's -c include.path=<file> option loads any local file as an additional config file. The advisory says a loaded file can then set core.sshCommand, a key the plugin would otherwise refuse, and the next remote operation in the same clone runs the attacker's command.

The advisory sets out the exploitation chain. The attacker first needs to write a small Git config file to any path the simple-git process can read. It lists realistic ways to do that, including file uploads such as avatars or attachments, CI artefacts, a shared /tmp directory on multi-tenant runners, predictable artefact paths, and container volume mounts. The attacker then triggers a clone with the crafted argument. Because simple-git always puts the subcommand first, a user-controlled -c always lands after it, and the advisory notes that git clone is the one Git subcommand that honours -c in that position. It says fetch, pull and push all reject the placement.

A fix is in progress but incomplete, according to the advisory. Pull request #1167, merged to the main branch on 10 May 2026 and not yet released to npm, adds an include.path entry to the denylist. The helper that builds the check turns the string into the regular expression /\s*include.path/, where the full stop is a wildcard that matches exactly one character. Conditional include keys take the form includeIf.<condition>.path, so the text between include and path is always longer than one character and the test fails. The advisory gives worked examples: the plain spelling matches, while includeif.gitdir:.path and includeif.onbranch:main.path do not. It says the argument parser itself correctly recognises both forms as config writes, so the defect is purely in the denylist.

The advisory also flags a secondary route. The list of environment variables stripped from the spawned process when set through git.env(...) does not include HOME or XDG_CONFIG_HOME. Setting HOME to a directory the attacker controls makes Git read a config file from there, giving the same primitive.

The advisory places the bug in the same class as an earlier chain of incomplete denylist fixes in simple-git, listing CVE-2022-24433, CVE-2022-24066, CVE-2022-25912, CVE-2022-25860, CVE-2026-28291 and CVE-2026-28292. It states that include and includeIf are not referenced in any published advisory, in any commit before pull request #1167, or anywhere in the 3.36.0 source. The record lists the status as reported.