simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
Date: 2026-03
Affected: npm/simple-git
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-28292
CWE: CWE-178
CWE-78
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

### Summary The `blockUnsafeOperationsPlugin` in `simple-git` fails to block git protocol override arguments when the config key is passed in uppercase or mixed case. An attacker who controls arguments passed to git operations can enable the `ext::` protocol by passing `-c PROTOCOL.ALLOW=always`, which executes an arbitrary OS command on the host machine. --- ### Details The `preventProtocolOverride` function in `simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts` (line 24) checks whether a `-c` argument configures `protocol.allow` using this regex: ```ts if (!/^\s*protocol(.[a-z]+)?.allow/.test(next)) { return; } ``` This regex is case-sensitive. Git treats config key names case-insensitively — it normalises them to lowercase internally. As a result, passing `PROTOCOL.ALLOW=always`, `Protocol.Allow=always`, or any mixed-case variant is not matched by the regex, the check returns without throwing, and git is spawned with the unsafe argument. **Verification that git normalises the key:** ```bash $ git -c PROTOCOL.ALLOW=always config --list | grep protocol protocol.allow=always ``` **The fix is a single character — add the `/i` flag:** ```ts // Before (vulnerable): if (!/^\s*protocol(.[a-z]+)?.allow/.test(next)) { // After (fixed): if (!/^\s*protocol(.[a-z]+)?.allow/i.test(next)) { ``` --- ## poc.js ```js /** * Proof of Concept — simple-git preventProtocolOverride Case-Sensitivity Bypass * * CVE-2022-25912 was fixed in simple-git@3.15.0 by adding a


Mitigations:

Architectural layers (MAESTRO):