simple-git Command Injection to Remote Code Execution PoC (CVE-2026-6951)

CVE

CVE-2026-6951

Vendor

simple-git

Product

simple-git

Affected versions

< 3.36.0

CVSS

8.2

Published

2026-09-28 08:48

Collected

2026-09-29 05:06

---
id: 8852
title: "simple-git Command Injection to Remote Code Execution PoC (CVE-2026-6951)"
cve: CVE-2026-6951
cvss: 8.2
severity: high
vendor: "simple-git"
product: "simple-git"
affected_versions: "< 3.36.0"
source_domain: github.com
source_url: "https://github.com/EQSTLab/CVE-2026-6951"
published_at: "2026-09-28T08:48:23Z"
tags: ["rce", "supply-chain", "poc", "command-injection", "nodejs", "simple-git", "cve-2026-6951"]
phying_url: "https://phying.com/item/8852"
lang: en
---

# simple-git Command Injection to Remote Code Execution PoC (CVE-2026-6951)

## Summary

EQSTLab released a verified exploit PoC and Docker lab for CVE-2026-6951, a high-severity RCE vulnerability in the Node.js library simple-git. Due to an incomplete fix for CVE-2022-25912, long-form --config options and GIT_CONFIG_* environment variables were not properly blocked. By configuring protocol.ext.allow=always alongside an ext:: protocol repository URL during clone operations, attackers can execute arbitrary shell commands on the host. Affects simple-git prior to 3.36.0.

## Why it matters

simple-git is downloaded tens of millions of times monthly across CI/CD and developer tools; services exposing Git clone/import features to untrusted input face direct server compromise.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-6951
- **CVSS:** 8.2
- **Vendor:** simple-git
- **Product:** simple-git
- **Affected versions:** < 3.36.0
- **Published:** 2026-09-28T08:48:23Z
- **Original:** https://github.com/EQSTLab/CVE-2026-6951
- **Phying News:** https://phying.com/item/8852