CVE-2026-102829

[CVE catalog]

Severity

Critical · CVSS 9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Sep 29, 2026, 6:46:58 PM UTC

Updated

Sep 29, 2026, 7:17:25 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.27% · Oct 27, 2026

A flaw was found in simple-git. The software fails to include the VISUAL environment variable in its unsafe editor detection checks. If a consuming application accepts untrusted environment variables, an attacker can specify a malicious program that Git launches during interactive operations, leading to arbitrary code execution with the privileges of the Node.js process. simple-git: simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection An Important severity flaw was found in simple-git, which is used by the grafana component in Red Hat Enterprise Linux 8. The @simple-git/argv-parser package used by simple-git omits the VISUAL environment variable from its unsafe-editor detection: VISUAL is missing from GitEnvKeys, so the parser drops the value before it can be classified as allowUnsafeEditor. If a consuming application forwards attacker-influenced environment variables into the environment passed to Git child processes, an attacker can supply a VISUAL value that Git uses to launch an attacker-selected editor during operations that open an editor, such as commit amendment or interactive rebase, resulting in arbitrary code execution with the privileges of the Node.js process. Exploitation requires several preconditions: the consuming application must forward attacker-influenced environment values to Git, the Git operation must open an editor, no higher-priority editor setting (GIT_EDITOR, core.editor, or EDITOR) may override VISUAL, and Git's terminal prerequisites must be met. For this reason Red Hat rates this flaw Important (CVSS 8.1, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the upstream CVE record assigns a Critical score (CVSS 9.2) that does not account for the high attack complexity of the required application data flow. Among Red Hat products, grafana in Red Hat Enterprise Linux 8 (the 8.4 and 8.6 update streams) is affected and a fix is being pursued; grafana and grafana-pcp in Red Hat Enterprise Linux 8.10, 9, and 10 and in Red Hat In-Vehicle OS 2 are not affected because the vulnerable component is not present. Affectedness of other Red Hat products is still under assessment. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.