simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it as allowUnsafeEditor. A consuming application that forwards attacker-influenced environment values can therefore allow Git to invoke an attacker-selected editor during operations such as commit amendment or interactive rebase when no higher-priority editor setting overrides VISUAL and Git's terminal prerequisites are met. The executable runs with the privileges of the Node.js process. This issue is fixed in argv-parser 2.0.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - simple-git, an interface for running git commands in any node.js application, enables applications to
    execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL
    from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it as
    allowUnsafeEditor. A consuming application that forwards attacker-influenced environment values can
    therefore allow Git to invoke an attacker-selected editor during operations such as commit amendment or
    interactive rebase when no higher-priority editor setting overrides VISUAL and Git's terminal
    prerequisites are met. The executable runs with the privileges of the Node.js process. This issue is fixed
    in argv-parser 2.0.1. (CVE-2026-102829)

ID	Name	Product	Family	Type	Severity
474360	Chainguard: multiple keycloak-26.8 packages: security update to 26.8.0-r1	Tenable Cloud Security	Chainguard Local Security Checks	Local	critical
474360	Chainguard: multiple keycloak-26.8 packages: security update to 26.8.0-r1	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	critical
473025	SCA: security update for @simple-git/argv-parser (GHSA-v5rq-49vh-5v5c)	Tenable Cloud Security	SCA Checks	Local	critical
473025	SCA: security update for @simple-git/argv-parser (GHSA-v5rq-49vh-5v5c)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-102829

critical

Tenable Plugins

critical

critical

critical

critical