CVE-2026-28292

CriticalCVSS 9.8/10Last modified Jul 15, 2026

Description

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-178 CWE-76

Affected software

Vendor	Product	Versions
steveukx	simple-git	>= 3.15.0, < 3.32.3
Red Hat	Logging Subsystem for Red Hat OpenShift	—
Red Hat	Logging Subsystem for Red Hat OpenShift	—
Red Hat	Logging Subsystem for Red Hat OpenShift	—
Red Hat	Logging Subsystem for Red Hat OpenShift	—
Red Hat	Logging Subsystem for Red Hat OpenShift	—
Red Hat	Logging Subsystem for Red Hat OpenShift	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat JBoss Enterprise Application Platform 8	—
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	—
Red Hat	Red Hat Process Automation 7	—

References

Timeline

Published: Mar 10, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-282954.3A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and por CVE-2026-282964.3A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted CVE-2026-282978.7SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead CVE-2026-282988.1SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead CVE-2026-282997.5SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk s CVE-2026-28306.1The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflected Cross-Site Script CVE-2026-283014.8A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website.CVE-2026-283029.1SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote c CVE-2026-283049.1SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remot CVE-2026-283059.1SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A CVE-2026-283069.1SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a sy CVE-2026-283079.1SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator g