CVE-2026-6951
Published: 25 April 2026
Summary
CVE-2026-6951 is a high-severity Code Injection (CWE-94) vulnerability in Simple-Git Project Simple-Git. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-6951 is a remote code execution (RCE) vulnerability (CWE-94) in versions of the simple-git npm package before 3.36.0. It stems from an incomplete fix for CVE-2022-25912, which blocked the -c option for Git configurations but failed to address the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, attackers can bypass protections and execute arbitrary code.
The vulnerability has a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network with low complexity and no privileges or user interaction required. Any remote attacker able to influence the options argument—such as through user-supplied repository URLs or configuration in applications using simple-git—can achieve RCE by setting protocol.ext.allow=always via --config and specifying an ext:: clone source, leading to full compromise of confidentiality, integrity, and availability.
Advisories from Snyk (SNYK-JS-SIMPLEGIT-15456078) and the upstream patch commit in the git-js repository recommend upgrading to simple-git version 3.36.0 or later, which addresses the --config bypass. Practitioners should audit dependencies for vulnerable simple-git usage and validate all inputs to Git options.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25639
Vulnerability details
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument…
more
passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-6951 is a network-accessible RCE vulnerability exploitable via untrusted input to simple-git options, directly mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely remediation of flaws, directly addressing the incomplete fix in simple-git before 3.36.0 by requiring upgrades to patched versions.
Requires validation of untrusted inputs to simple-git options, preventing malicious --config settings like protocol.ext.allow=always from enabling RCE.
Enables vulnerability scanning to identify deployments using vulnerable simple-git versions, allowing prioritization of remediation.