PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.
← Back | CVE Intelligence Hub

CVE-2026-6951[High]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-6951.

Vendor
simple-git
Product
simple-git
Affected versions
< 3.36.0
CVSS
8.2
Coverage Span
2026-09-28
Reports
1 related reports

Associated Reports & Timeline

1.
simple-git Command Injection to Remote Code Execution PoC (CVE-2026-6951)
github.com | vulnerability | High | | Original ↗ | .md | #rce | #supply-chain | #poc | #command-injection
EQSTLab released a verified exploit PoC and Docker lab for CVE-2026-6951, a high-severity RCE vulnerability in the Node.js library simple-git. Due to an incomplete fix for CVE-2022-25912, long-form --config options and GIT_CONFIG_* environment variables were not properly blocked. By configuring protocol.ext.allow=always alongside an ext:: protocol repository URL during clone operations, attackers can execute arbitrary shell commands on the host. Affects simple-git prior to 3.36.0.
Why it matters: simple-git is downloaded tens of millions of times monthly across CI/CD and developer tools; services exposing Git clone/import features to untrusted input face direct server compromise.