CVE-2026-6951
Published: 25 April 2026
Description
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument…
more
passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely remediation of flaws, directly addressing the incomplete fix in simple-git before 3.36.0 by requiring upgrades to patched versions.
Requires validation of untrusted inputs to simple-git options, preventing malicious --config settings like protocol.ext.allow=always from enabling RCE.
Enables vulnerability scanning to identify deployments using vulnerable simple-git versions, allowing prioritization of remediation.
Security SummaryAI
CVE-2026-6951 is a remote code execution (RCE) vulnerability (CWE-94) in versions of the simple-git npm package before 3.36.0. It stems from an incomplete fix for CVE-2022-25912, which blocked the -c option for Git configurations but failed to address the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, attackers can bypass protections and execute arbitrary code.
The vulnerability has a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network with low complexity and no privileges or user interaction required. Any remote attacker able to influence the options argument—such as through user-supplied repository URLs or configuration in applications using simple-git—can achieve RCE by setting protocol.ext.allow=always via --config and specifying an ext:: clone source, leading to full compromise of confidentiality, integrity, and availability.
Advisories from Snyk (SNYK-JS-SIMPLEGIT-15456078) and the upstream patch commit in the git-js repository recommend upgrading to simple-git version 3.36.0 or later, which addresses the --config bypass. Practitioners should audit dependencies for vulnerable simple-git usage and validate all inputs to Git options.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-6951 is a network-accessible RCE vulnerability exploitable via untrusted input to simple-git options, directly mapping to exploitation of public-facing applications.