`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0177 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-28292:
    `simple-git`, an interface for running git commands in any node.js application, has an issue in versions     3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and     CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an     updated fix for the vulnerability.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - `simple-git`, an interface for running git commands in any node.js application, has an issue in versions
    3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and
    CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an
    updated fix for the vulnerability. (CVE-2026-28292)

ID	Name	Product	Family	Type	Severity
303488	TencentOS Server 4: grafana (TSSA-2026:0177)	Nessus	Tencent Local Security Checks	Local	critical
438629	SCA: security update for simple-git (GHSA-r275-fr43-pm7q)	Tenable Cloud Security	SCA Checks	Local	high
438629	SCA: security update for simple-git (GHSA-r275-fr43-pm7q)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-28292

high

Tenable Plugins

critical

high

high