simple-git patches RCE via --config option injection

TL;DR - simple-git option filtering blocked -c but not --config, so attacker-controlled options can re-enable dangerous Git protocols and reach RCE via ext:: clone sources.

What happened

simple-git is a Node.js wrapper that shells out to the git CLI, commonly used anywhere code needs to clone, fetch, or inspect repos.

CVE-2026-6951 is a critical RCE issue caused by an incomplete prior fix: simple-git blocks the -c option, but the equivalent long-form --config is still allowed. If untrusted input can reach the options argument passed to simple-git, an attacker can set protocol.ext.allow=always and then use an ext:: clone source to execute code.

This is a recurring high-leverage failure mode for developer tooling: when untrusted input influences git invocation, you are one parsing gap away from turning “clone a repo” into “run arbitrary commands”, especially in CI and multi-tenant automation.

Who is impacted

• Projects using simple-git versions < 3.36.0.
• Highest-risk deployments are those where attacker-controlled inputs can influence simple-git's options argument (directly or via higher-level wrappers), particularly in CI/CD, build services, and “import a repo URL” features.

What to do now

• Follow vendor remediation guidance and apply a release that is not in the affected range.

  "Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE)"

• Inventory where simple-git is used and specifically audit call sites that pass an options array or build option strings from external inputs (HTTP params, repo metadata, webhook payloads, SCM events).
• Until you are confident you are on a patched version, treat options as a high-risk API surface:
  • avoid passing user-controlled values into options
  • enforce an allowlist of known-safe flags at the application boundary (not a blocklist)
• If compromise is suspected, review CI and service logs for unexpected git invocations and rotate credentials exposed to the affected runtime (deploy keys, tokens, registry credentials).