CVE-2026-102827

[CVE catalog]

Severity

High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

Sep 29, 2026, 6:39:57 PM UTC

Updated

Sep 29, 2026, 7:17:25 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.58% · Oct 25, 2026

A flaw was found in simple-git. This vulnerability allows an attacker who can influence command arguments to achieve arbitrary command execution on the host system. The library's security filter checks for dangerous options using exact names but fails to account for Git accepting abbreviated command options. Consequently, an attacker can supply abbreviated push options to bypass validation checks and execute arbitrary commands in applications that process untrusted input. simple-git: simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) A flaw was found in the simple-git Node.js library, which Red Hat ships as a bundled dependency in products such as grafana in Red Hat Enterprise Linux. The library's default blockUnsafeOperationsPlugin security filter compares parsed option names against the literal spellings of dangerous git options, but git accepts unambiguous long-option abbreviations. An attacker who can influence the command arguments an application passes to simple-git can therefore use abbreviated forms such as --receive-p or --exe (for --receive-pack or --exec) to bypass the filter on the git push path and cause git to invoke an attacker-selected command, resulting in arbitrary command execution on the host. The flaw only manifests in applications that process untrusted input and pass attacker-controlled arguments to simple-git git operations. Red Hat rates this flaw as IMPORTANT with a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while NIST rates it CRITICAL with 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the difference reflects Red Hat's assessment that exploitation depends on an application exposing attacker-influenced arguments to simple-git, which increases real-world attack complexity. Within Red Hat's product portfolio the affectedness varies by code path: for example, grafana-pcp in Red Hat Enterprise Linux is not affected because the vulnerable code is not in the execute path, and grafana streams in which the vulnerable code is not present are not affected. For affected Red Hat products the consequence is arbitrary command execution, and fixes are being pursued through the respective affected components. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.