CVE-2026-6951

[CVE catalog]

Severity

High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Published

Apr 25, 2026, 5:00:05 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.88% · Oct 25, 2026

A flaw was found in simple-git. A remote attacker could exploit this vulnerability by providing specially crafted input to the options argument, bypassing a previous security fix. This incomplete fix allows an attacker to enable certain protocol extensions, which could lead to remote code execution. simple-git: simple-git: Remote Code Execution due to incomplete fix bypass This Important flaw in the `simple-git` library allows for Remote Code Execution when untrusted input is passed to the options argument. An attacker could bypass a previous security fix by enabling specific protocol extensions, leading to arbitrary code execution. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.