simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - simple-git, an interface for running git commands in any node.js application, enables applications to
    execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin
    does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-
    controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke
    an attacker-selected shell command when git interpret-trailers processes the configured trailer. The
    command executes with the operating-system identity and permissions of the Node.js process. This issue is
    fixed in 4.0.1. (CVE-2026-102828)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - simple-git, an interface for running git commands in any node.js application, enables applications to     execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin     does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-     controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke     an attacker-selected shell command when git interpret-trailers processes the configured trailer. The     command executes with the operating-system identity and permissions of the Node.js process. This issue is     fixed in 4.0.1. (CVE-2026-102828)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474359	Chainguard: multiple keycloak-26.8 packages: security update to 26.8.0-r1	Tenable Cloud Security	Chainguard Local Security Checks	Local	critical
474359	Chainguard: multiple keycloak-26.8 packages: security update to 26.8.0-r1	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	critical
472949	SCA: security update for simple-git (GHSA-x6jw-m9v5-85vh)	Tenable Cloud Security	SCA Checks	Local	critical
472949	SCA: security update for simple-git (GHSA-x6jw-m9v5-85vh)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
363055	Linux Distros Unpatched Vulnerability : CVE-2026-102828	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-102828

critical

Tenable Plugins

critical

critical

critical

critical

critical