Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an
    incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks
    the -c option but not the equivalent --config form. If untrusted input can reach the options argument
    passed to simple-git, an attacker may still achieve remote code execution by enabling
    protocol.ext.allow=always and using an ext:: clone source. (CVE-2026-6951)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an     incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks     the -c option but not the equivalent --config form. If untrusted input can reach the options argument     passed to simple-git, an attacker may still achieve remote code execution by enabling     protocol.ext.allow=always and using an ext:: clone source. (CVE-2026-6951)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
441265	SCA: security update for simple-git (GHSA-hffm-xvc3-vprc)	Tenable Cloud Security	SCA Checks	Local	critical
441265	SCA: security update for simple-git (GHSA-hffm-xvc3-vprc)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
312303	Linux Distros Unpatched Vulnerability : CVE-2026-6951	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-6951

critical

Tenable Plugins

critical

critical

critical