https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:29:39 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2026-al17033 <p><strong>Affected:</strong> CleanStart: renovate</p> <p>CVE-2026-28292 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: renovate</p> <p>CVE-2026-28292 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-al17033 https://cve.radiocsirt.org/vuln/euvd-2026-337388 EUVD-2026-337388 https://cve.radiocsirt.org/vuln/euvd-2026-337388 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28292 <p>`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.</p> <p>`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28292 https://cve.radiocsirt.org/vuln/ghsa-r275-fr43-pm7q <p><strong>Affected:</strong> npm: simple-git</p> <p>### Summary</p> <p>The `blockUnsafeOperationsPlugin` in `simple-git` fails to block git protocol override arguments when the config key is passed in uppercase or mixed case. An attacker who controls arguments passed to git operations can enable the `ext::` protocol by passing `-c PROTOCOL.ALLOW=always`, which executes an arbitrary OS command on the host machine.</p> <p>---</p> <p>### Details</p> <p>The `preventProtocolOverride` function in `simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts` (line 24) checks whether a `-c` argument configures `protocol.allow` using this regex:</p> <p>```ts if (!/^\s*protocol(.[a-z]+)?.allow/.test(next)) { return; } ```</p> <p>This regex is case-sensitive. Git treats config key names case-insensitively — it normalises them to lowercase internally. As a result, passing `PROTOCOL.ALLOW=always`, `Protocol.Allow=always`, or any mixed-case variant is not matched by the regex, the check returns without throwing, and git is spawned with the unsafe argument.</p> <p>**Verification that git normalises the key:**</p> <p>```bash $ git -c PROTOCOL.ALLOW=always config --list | grep protocol protocol.allow=always ```</p> <p>**The fix is a single character — add the `/i` flag:**</p> <p>```ts // Before (vulnerable): if (!/^\s*protocol(.[a-z]+)?.allow/.test(next)) {</p> <p>// After (fixed): if (!/^\s*protocol(.[a-z]+)?.allow/i.test(next)) { ```</p> <p>---</p> <p>## poc.js</p> <p>```js /** * Proof of Concept — simple-git preventProtocolOverride Case-Sensitivity Bypass * * CVE-2022-25912 was fixed in simple-git@3.15.0 by adding…</p> <p><strong>Affected:</strong> npm: simple-git</p> <p>### Summary</p> <p>The `blockUnsafeOperationsPlugin` in `simple-git` fails to block git protocol override arguments when the config key is passed in uppercase or mixed case. An attacker who controls arguments passed to git operations can enable the `ext::` protocol by passing `-c PROTOCOL.ALLOW=always`, which executes an arbitrary OS command on the host machine.</p> <p>---</p> <p>### Details</p> <p>The `preventProtocolOverride` function in `simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts` (line 24) checks whether a `-c` argument configures `protocol.allow` using this regex:</p> <p>```ts if (!/^\s*protocol(.[a-z]+)?.allow/.test(next)) { return; } ```</p> <p>This regex is case-sensitive. Git treats config key names case-insensitively — it normalises them to lowercase internally. As a result, passing `PROTOCOL.ALLOW=always`, `Protocol.Allow=always`, or any mixed-case variant is not matched by the regex, the check returns without throwing, and git is spawned with the unsafe argument.</p> <p>**Verification that git normalises the key:**</p> <p>```bash $ git -c PROTOCOL.ALLOW=always config --list | grep protocol protocol.allow=always ```</p> <p>**The fix is a single character — add the `/i` flag:**</p> <p>```ts // Before (vulnerable): if (!/^\s*protocol(.[a-z]+)?.allow/.test(next)) {</p> <p>// After (fixed): if (!/^\s*protocol(.[a-z]+)?.allow/i.test(next)) { ```</p> <p>---</p> <p>## poc.js</p> <p>```js /** * Proof of Concept — simple-git preventProtocolOverride Case-Sensitivity Bypass * * CVE-2022-25912 was fixed in simple-git@3.15.0 by adding…</p> https://cve.radiocsirt.org/vuln/ghsa-r275-fr43-pm7q https://cve.radiocsirt.org/vuln/opensuse-su-2026:10327-1 <p>heroic-games-launcher-2.20.1-3.1 on GA media</p> <p>heroic-games-launcher-2.20.1-3.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10327-1