simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - simple-git, an interface for running git commands in any node.js application, enables applications to
    execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not
    completely reject configuration includes supplied through customArgs to git.clone(). The missing
    include.path classification permits Git to load an attacker-controlled configuration file, and the initial
    remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a
    conditional include. A loaded configuration can set an executable Git option such as core.sshCommand,
    which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation
    requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled
    file that the process can read. This issue is fixed in 4.0.0. (CVE-2026-102826)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - simple-git, an interface for running git commands in any node.js application, enables applications to     execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not     completely reject configuration includes supplied through customArgs to git.clone(). The missing     include.path classification permits Git to load an attacker-controlled configuration file, and the initial     remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a     conditional include. A loaded configuration can set an executable Git option such as core.sshCommand,     which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation     requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled     file that the process can read. This issue is fixed in 4.0.0. (CVE-2026-102826)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474363	Chainguard: multiple keycloak-26.8 packages: security update to 26.8.0-r1	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
474363	Chainguard: multiple keycloak-26.8 packages: security update to 26.8.0-r1	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
472952	SCA: security update for simple-git (GHSA-g4wm-2vf7-vfgr)	Tenable Cloud Security	SCA Checks	Local	high
472952	SCA: security update for simple-git (GHSA-g4wm-2vf7-vfgr)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
362439	Linux Distros Unpatched Vulnerability : CVE-2026-102826	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-102826

high

Tenable Plugins

high

high

high

high

high