AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-78

https://access.redhat.com/security/cve/CVE-2026-28291

https://bugzilla.redhat.com/show_bug.cgi?id=2457930

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28291.json

[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Process Automation 7","defaultStatus":"affected","cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:jbosseapxp"]}]

{"timestamp":"2026-04-14T13:53:36.631739Z","id":"CVE-2026-28291","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"steveukx","product":"git-js","versions":[{"version":"< 3.32.0","status":"affected"}]}]

OR
          *cpe:2.3:a:simple-git_project:simple-git:*:*:*:*:*:node.js:*:* versions up to (excluding) 3.32.0

CISA-ADP: https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287 Types: Exploit, Vendor Advisory

GitHub, Inc.: https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26 Types: Product

GitHub, Inc.: https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d Types: Patch

GitHub, Inc.: https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0 Types: Release Notes

GitHub, Inc.: https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287 Types: Exploit, Vendor Advisory

GitHub, Inc.: https://www.cve.org/CVERecord?id=CVE-2022-25860 Types: Third Party Advisory, VDB Entry

https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d

https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-78

https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26

https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0

https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287

https://www.cve.org/CVERecord?id=CVE-2022-25860