Remote Code Execution Vulnerability in Simple-Git by Simple Git

CVE-2026-6951

What is CVE-2026-6951?

Versions of the Simple-Git package prior to 3.36.0 are impacted by a Remote Code Execution vulnerability due to an incomplete patch for a previous security issue. The vulnerability arises because the code does not adequately block the use of the --config option, allowing attackers to send untrusted input to the options argument. This can lead to remote code execution if the protocol.ext.allow is set to always and malicious external sources are utilized. Users are advised to upgrade to the latest version to mitigate the risk.

References