CVE-2026-102828

[CVE catalog]

Severity

Critical · CVSS 9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Sep 29, 2026, 6:43:19 PM UTC

Updated

Sep 29, 2026, 7:17:25 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.37% · Oct 25, 2026

A flaw was found in simple-git. The default security filter designed to block unsafe Git operations does not prevent trailer command configurations from being set. If an application passes untrusted user input into Git configuration options, an attacker can exploit this flaw to achieve arbitrary code execution. Injected commands run with the operating-system privileges of the underlying Node.js process. simple-git: simple-git unsafe-operation guard does not block trailer command configuration A flaw was found in simple-git, a Node.js interface for running Git commands, and is rated IMPORTANT by Red Hat Product Security. It affects Red Hat products that bundle a vulnerable version of the library, including the grafana component in Red Hat Enterprise Linux 10.0 and 9.6, Red Hat Build of Keycloak, and Konflux. The library's default blockUnsafeOperationsPlugin, which is designed to block unsafe Git configuration, does not classify trailer.<token>.cmd as unsafe configuration. If an application passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments, Git invokes an attacker-selected shell command when git interpret-trailers processes the configured trailer, resulting in arbitrary command execution with the operating-system identity and permissions of the Node.js process. Exploitation requires the application to pass untrusted input into Git configuration options, which is why Red Hat rates this flaw IMPORTANT rather than the CRITICAL severity assigned upstream. Other Red Hat product streams, including RHEL 8, the remaining RHEL 9 and RHEL 10 grafana and grafana-pcp builds, and the JBoss EAP maven repositories, are not affected because the vulnerable code is not present or not in the execution path. Fixes for the affected products are being pursued by the responsible product teams. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.