CVE-2026-28292 — AI Deep Analysis Summary

🚨 **Essence**: Simple Git < 3.32.2 has a critical flaw allowing **Remote Code Execution (RCE)**. 📉 **Consequences**: Attackers bypass previous CVE fixes to gain full control of the host machine.…

🛡️ **Root Cause**: **CWE-78** (OS Command Injection). 🐛 **Flaw**: Improper neutralization of special elements used in an OS command. ⚠️ **Note**: It specifically bypasses earlier security patches.

👥 **Vendor**: Steve King (steveukx). 📦 **Product**: Simple Git. 📅 **Affected Versions**: **3.15.0** through **3.32.2**. 🚫 **Safe**: Versions > 3.32.2.

💻 **Privileges**: Full **Remote Code Execution**. 🔓 **Access**: Complete control over the host. 📂 **Data**: High risk to Confidentiality, Integrity, and Availability (CVSS: 9.8). 🎯 **Goal**: Arbitrary command execution.

🔓 **Auth**: None required (**PR:N**). 🌐 **Network**: Remote (**AV:N**). 🧠 **Complexity**: Low (**AC:L**). 🖱️ **UI**: None needed (**UI:N**). 📉 **Threshold**: **EXTREMELY LOW**. Easy to exploit.

📜 **Public Exp**: No specific PoC code listed in data. 🔍 **Status**: Advisory confirmed (GHSA-r275-fr43-pm7q). ⚠️ **Risk**: High likelihood of wild exploitation due to low complexity and RCE nature.

🔍 **Check**: Scan for `simple-git` dependency in `package.json`. 📊 **Version**: Verify if version is between **3.15.0** and **3.32.2**. 🛠️ **Tool**: Use npm audit or SAST tools detecting CWE-78.

✅ **Fixed**: Yes. 📝 **Patch**: Upgrade to version **> 3.32.2**. 🔗 **Source**: GitHub commit f7042088aa2dac59e3c49a84d7a2f4b26048a257. 🔄 **Action**: Immediate update required.

🚧 **Workaround**: If unpatched, **sanitize all inputs** passed to git commands. 🚫 **Restrict**: Disable external git remote calls if possible. 🛡️ **WAF**: Implement strict input filtering for shell metacharacters.

🔥 **Priority**: **CRITICAL** (CVSS 9.8). 🚨 **Urgency**: **IMMEDIATE ACTION**. ⏳ **Deadline**: Patch within 24-48 hours. 📢 **Alert**: High risk of active exploitation in the wild.