steveukx git-js
5 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-102829 | < 2.0.1 | simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection | CRITICAL 9.2 | 0.3 % | ||
| CVE-2026-102828 | >= 3.15.0, < 4.0.1 | simple-git unsafe-operation guard does not block trailer command configuration | CRITICAL 9.2 | 0.4 % | ||
| CVE-2026-102827 | < 4.0.0 | simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-20… | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-102826 | < 4.0.0 | simple-git allows command execution through unblocked Git configuration includes | HIGH 8.1 | 0.5 % | ||
| CVE-2026-28291 | < 3.32.0 | simple-git has Command Execution via Option-Parsing Bypass | HIGH 8.1 | 0.8 % |