OS Command Injection in @simple-git/argv-parser (CVE-2026-102829)
Summary
OS command injection in @simple-git/argv-parser (CVE-2026-102829). Risk of unauthorized operations or information disclosure. Exploitable via VISUAL. Mitigation: upgrade to 2.0.1 or later.
Original description
The description as published by the source.
Security control bypass in @simple-git/argv-parser: Git's VISUAL editor fallback is not classified as allowUnsafeEditor
Report metadata
| Field | Value |
|---|---|
| Package | @simple-git/argv-parser (npm, pkg:npm/%40simple-git/argv-parser) |
| Repository | https://github.com/steveukx/git-js |
| Component | parseEnv (packages/argv-parser/src/env/parse-env.ts), reached via vulnerabilityCheck(tokens, env) |
| Vulnerability class | Security-control bypass — incomplete denylist in unsafe-editor detection |
| Verified against | c427fbad33f1f2b11341f1cf852eedecbb106400 (@simple-git/argv-parser 1.1.1), plus the published npm artifact 1.1.1; main at 98864c6 observed still unpatched |
| API surface | Public documented API (parseEnv(raw) / vulnerabilityCheck(tokens, env)) |
| Affected in default configuration | Yes — reproduced with blockUnsafeOperationsPlugin under default options, with no unsafe allowances enabled |
Summary
GitEnvKeys in packages/argv-parser/src/env/parse-env.ts maps only editor, git_editor and git_sequence_editor to the allowUnsafeEditor category. prepareEnv keeps an environment entry only when its lowercased name is a known GitEnvKey or starts with git, so VISUAL is discarded before collectConfigVulnerabilities ever inspects it. Git, however, falls back to VISUAL when resolving an editor, so parseEnv({ VISUAL: '/tmp/evileditor' }) reports no vulnerability while an interactive Git operation will…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-102829 has been found in @simple-git/argv-parser.
Attackers can target a specific entry point like VISUAL over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade @simple-git/argv-parser to 2.0.1 or later.
If unsure, ask your IT team or search "@simple-git/argv-parser CVE-2026-102829" on the vendor's site.
CVE-2026-102829 (@simple-git/argv-parser) — CWE-78
Attack surface: VISUAL / allowUnsafeEditor / parseEnv / c427fbad33f1f2b11341f1cf852eedecbb106400
Patched: 2.0.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
OS command injection (CWE-78) exists in @simple-git/argv-parser. Attackers reach the vulnerable code path via VISUAL.
Check the vendor advisory for the affected versions of @simple-git/argv-parser. Attack surface: VISUAL / allowUnsafeEditor / parseEnv / c427fbad33f1f2b11341f1cf852eedecbb106400.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 2.0.1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r '@simple-git/argv-parser' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r '@simple-git/argv-parser' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
@simple-git/argv-parserを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade @simple-git/argv-parser to 2.0.1ステージング環境で 2.0.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com