CVE-2026-102826

[CVE catalog]

Severity

High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

Sep 29, 2026, 6:37:10 PM UTC

Updated

Sep 29, 2026, 7:17:24 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.46% · Oct 25, 2026

A flaw was found in simple-git. The library fails to properly sanitize Git configuration directives passed through custom clone arguments, which allows Git to load an attacker-controlled configuration file. By specifying executable settings within that configuration, an attacker can achieve arbitrary code execution with the privileges of the application process. Exploitation requires the host application to accept untrusted clone arguments and requires access to a readable, attacker-controlled file on the system. simple-git: simple-git allows command execution through unblocked Git configuration includes An important-severity operating system command injection flaw affects Red Hat products that bundle the simple-git Node.js library, including Red Hat Enterprise Linux (grafana-pcp), Red Hat Build of Keycloak, Red Hat In-Vehicle OS, and Konflux (mintmaker-renovate-image). The default blockUnsafeOperationsPlugin in simple-git does not completely reject Git configuration include directives (include.path and includeIf.<condition>.path) supplied through customArgs to git.clone(). If an application flows attacker-influenced data into these custom clone arguments, an attacker can direct Git to load an attacker-controlled configuration file; that configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation, resulting in arbitrary command execution with the privileges of the Node.js process. Exploitation requires the host application to pass untrusted clone arguments and requires the attacker to control a file readable by the process, so deployments that do not pass untrusted data into clone custom arguments are not exposed to this attack vector. Fixes are being pursued for the affected Red Hat products through the responsible engineering teams. Some product streams, including certain JBoss EAP maven repository artifacts and RHEL grafana-pcp builds, were determined not affected because the vulnerable component or vulnerable code is not present in those builds. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.