Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-25 | 3 | Disclosure2Patch1 |
| 2026-04-26 | 1 | PoC1 |
| 2026-04-27 | 1 | Disclosure1 |
🚨 simple-git Command Injection - CVE-2026-6951 User-controlled input → git command execution → RCE risk Widely used npm package → high impact Patch immediately https://github.com/advisories/GHSA-hffm-xvc3-vprc
Post summary
The analysis reveals a command‑injection vulnerability (CVE‑2026‑6951) in the widely‑used simple‑git npm package that could enable RCE; users are urged to apply the vendor patch immediately.
simple-git (the Node.js git wrapper pulled 9M times a week) shipped CVE-2026-6951 yesterday. Severity 9.8, remote command execution. The 2022 patch blocked one dangerous flag and missed its alias. A fix is not a fix until someone else tries to break it.
Post summary
The post announces the release of CVE-2026-6951 for simple-git, highlighting a severe remote command execution flaw and noting that a prior patch may not fully fix the vulnerability.
CVE-2026-6951 is a critical vulnerability associated with the simple-git package. It allows an attacker to perform Remote Code Execution (RCE) due to an incomplete fix for a previous vulnerability (CVE-2022-25912). The amusing part is that CVE-2022-25912 was fixed by blocking the -c option, which resulted in the emergence of CVE-2026-6951 because the ---config option was not blocked. If untrusted data can reach the options argument passed to simple-git, an attacker can achieve remote code execution by enabling the protocol.ext.allow=always parameter and using an ext:: clone source. PoC is available on GitHub https://github.com/binautopsy/research-labs/blob/main/cve-2026-6951/exploit.js #exploit #cve #vulnerability #poc #github
Post summary
CVE-2026-6951 is a critical RCE flaw in simple-git, with a PoC exploit script (exploit.js) publicly shared on GitHub.
CVE-2026-6951 Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vu… https://www.cve.org/CVERecord?id=CVE-2026-6951
Post summary
CVE-2026-6951 exposes simple-git versions prior to 3.36.0 to Remote Code Execution because of an incomplete fix for CVE-2022-25912.
CVE-2026-6951 Remote Code Execution in Simple-Git Before 3.36.0 via Incomplete Option Filtering https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6951
Post summary
This post discloses a remote code execution flaw in Simple‑Git versions prior to 3.36.0 caused by incomplete option filtering, with no indication of exploitation, mitigation, or PoC details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | simple-git_project | simple-git | - | node.js | - |