Most recent entries from all

CLEANSTART-2026-AL17033 — Security fix for CVE-2026-28292 applied in: renovate 43.4.3-r1, renovate 43.4.4-r0

2026-10-03T12:33:58.541747+00:00

Affected: CleanStart: renovate

CVE-2026-28292 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-337388

2026-10-03T12:33:58.541803+00:00

EUVD-2026-337388

fkie_cve-2026-28292

2026-10-03T12:33:58.541819+00:00

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.

GHSA-r275-fr43-pm7q — simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE

2026-10-03T12:33:58.541843+00:00

Affected: npm: simple-git

### Summary

The `blockUnsafeOperationsPlugin` in `simple-git` fails to block git protocol override arguments when the config key is passed in uppercase or mixed case. An attacker who controls arguments passed to git operations can enable the `ext::` protocol by passing `-c PROTOCOL.ALLOW=always`, which executes an arbitrary OS command on the host machine.

---

### Details

The `preventProtocolOverride` function in `simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts` (line 24) checks whether a `-c` argument configures `protocol.allow` using this regex:

```ts if (!/^\s*protocol(.[a-z]+)?.allow/.test(next)) { return; } ```

This regex is case-sensitive. Git treats config key names case-insensitively — it normalises them to lowercase internally. As a result, passing `PROTOCOL.ALLOW=always`, `Protocol.Allow=always`, or any mixed-case variant is not matched by the regex, the check returns without throwing, and git is spawned with the unsafe argument.

**Verification that git normalises the key:**

```bash $ git -c PROTOCOL.ALLOW=always config --list | grep protocol protocol.allow=always ```

**The fix is a single character — add the `/i` flag:**

```ts // Before (vulnerable): if (!/^\s*protocol(.[a-z]+)?.allow/.test(next)) {

// After (fixed): if (!/^\s*protocol(.[a-z]+)?.allow/i.test(next)) { ```

---

## poc.js

```js /** * Proof of Concept — simple-git preventProtocolOverride Case-Sensitivity Bypass * * CVE-2022-25912 was fixed in simple-git@3.15.0 by adding…

openSUSE-SU-2026:10327-1 — heroic-games-launcher-2.20.1-3.1 on GA media

2026-10-03T12:33:58.541925+00:00

heroic-games-launcher-2.20.1-3.1 on GA media