Bug 2461750 (CVE-2026-6951) - CVE-2026-6951 simple-git: simple-git: Remote Code Execution due to incomplete fix bypass
Summary: CVE-2026-6951 simple-git: simple-git: Remote Code Execution due to incomplete...
Keywords:
Status: NEW
Alias: CVE-2026-6951
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-25 06:01 UTC by OSIDB Bzimport
Modified: 2026-05-05 18:33 UTC (History)
29 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-25 06:01:13 UTC 
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.
Note You need to log in before you can comment on or make changes to this bug.