CVE-2026-28292
Critical
Description
`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.
SeverityCritical
CVSS9.8
Exploit probability—
ProductSimple-git
PublishedMar 10, 2026
First seenMar 10, 2026
Weakness typeCWE-78OS command injectionCWE-178CWE-178
How to fix
Update
- simple-git_project simple-git3.32.2 or later
- simple-git3.32.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simple-git_project simple-git | 3.15.0 ≤ v < 3.32.2 | 3.32.2 |
| simple-gitnpm | 3.15.0 ≤ v < 3.32.3 | 3.32.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.