CVE-2026-102826

{
  "etk_id": "ETK-2026-698",
  "cve_id": "CVE-2026-102826",
  "display_id": "CVE-2026-102826",
  "ghsa_id": "GHSA-g4wm-2vf7-vfgr",
  "euvd_id": "EUVD-2026-89332",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Command injection through clone options in simple-git",
  "summary": "simple-git versions before 4.0.0 do not fully block configuration include options supplied through custom arguments to clone operations. An attacker who can influence those arguments and provide a configuration file readable by the process may cause command execution with the application's privileges.",
  "mitigation": "Upgrade the npm simple-git package to version 4.0.0 or later. Until upgraded, do not pass untrusted input through clone custom arguments, and prevent untrusted users from controlling Git configuration paths or readable configuration files.",
  "vendor": "npm",
  "product": "npm:simple-git",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 3.36.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "4.0.0"
      ],
      "package_name": "simple-git",
      "purl": "pkg:npm/simple-git"
    }
  ],
  "cwes": null,
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0046,
  "epss_percentile": 0.3889,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 13.504596333333334,
  "t0_at": "2026-09-29T18:37:10.490000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-06T00:33:30.086039+00:00",
      "days": 6.247449028229167,
      "is_lower_bound": false,
      "measured_at": "2026-09-29T18:37:10.490000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-09-29T18:37:10.490000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-29T18:37:10.490000+00:00",
      "url": "https://github.com/advisories/GHSA-g4wm-2vf7-vfgr"
    }
  }
}