CVE-2026-28292

The vulnerability results from improper handling of input data passed to git commands in Node.js applications using the `simple-git` library. Input validation and sanitization mechanisms introduced as patches for CVE-2022-25860 and CVE-2022-25912 can be bypassed, classified as CWE-78 (command injection) and CWE-178 (improper case-sensitive comparison). An attacker can craft malicious input that will be interpreted as system commands and executed on the server.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely (RCE) on the host machine without authentication, which can lead to complete system compromise, data disclosure, or data modification.

The `simple-git` library should be updated to version 3.23.0 or higher containing the patch. Details are available in the project repository and in security advisory GHSA-r275-fr43-pm7q.

Simple-Git Project Simple-Git in versions from 3.15.0 to 3.32.2 (excluding version 3.23.0, which contains the patch). Affects Node.js applications using the `simple-git` library.