Security readout for executives and security teams
Plain-English summary
This affects Node.js applications that use simple-git to run Git operations. A bypass in safety checks can let attacker-controlled input make Git execute code on the host. The CVSS score is critical, but the supplied sources do not show CISA KEV listing or confirmed active exploitation.
Executive priority
Prioritize within emergency patch workflows for internet-facing or automated systems processing untrusted Git input. If simple-git is only used in trusted internal tooling, still schedule rapid remediation because impact is full host compromise.
Technical view
simple-git versions listed as >=3.15.0 and <3.32.3 can bypass blockUnsafeOperationsPlugin protections through case-insensitive protocol.allow configuration handling. The issue is described as bypassing prior fixes for CVE-2022-25860 and CVE-2022-25912, enabling remote code execution when unsafe Git options are reachable from attacker-controlled input.
Likely exposure
Exposure is most likely in Node.js services, CI systems, developer portals, importers, or automation that call simple-git with repository URLs, options, config keys, or clone parameters influenced by users or external data.
Exploitation context
The source bundle includes a public research reference tagged exploit, but KEV is false and no cited source confirms active exploitation. Treat public technical detail as raising urgency without claiming observed attacks.
Researcher notes
Key uncertainty: the bundle says affected versions are <3.32.3 but also states version 3.23.0 contains the updated fix. Do not rely on that inconsistent statement alone; verify against the vendor advisory and commit before closing remediation.
Mitigation direction
- Identify all applications and packages using simple-git.
- Upgrade outside the affected range after confirming vendor advisory guidance.
- Resolve the bundle's fixed-version inconsistency against the GitHub advisory.
- Restrict user control over Git options, config keys, and repository inputs.
- Review CI and automation runners for exposed simple-git workflows.
Validation and detection
- Search dependency manifests and lockfiles for simple-git versions.
- Confirm runtime dependency trees, including transitive use.
- Review code paths passing external input into simple-git calls.
- Check whether Git config options can be user-controlled.
- Verify patched deployments with dependency inventory evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-178: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-76: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-28292 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9GitHub_MCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-03-10T19:01:22.235Z: Reported to Red Hat.
- 2026-03-10T18:34:21.717Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/steveukx/git-js/security/advisories/GHSA-r275-fr43-pm7qCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/steveukx/git-js/commit/f7042088aa2dac59e3c49a84d7a2f4b26048a257CVE reference, GitHub_M · x_refsource_MISC
- https://www.codeant.ai/security-research/security-research-simple-git-remote-code-execution-cve-2026-28292CVE reference, GitHub_M · x_refsource_MISC
- https://www.codeant.ai/security-research/simple-git-remote-code-execution-cve-2026-28292CVE reference, CISA-ADP · exploit
- https://access.redhat.com/security/cve/CVE-2026-28292CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2446162CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28292.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Handling of Case Sensitivity
Improper Handling of Case Sensitivity represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Equivalent Special Elements
Improper Neutralization of Equivalent Special Elements represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.