CVE-2026-28291
OS command injection in Simple Git Project
CVSS score
8.1
EPSS probability
%0.9
Risk score
0.1
Published
6 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287
Makefile Go / Python
Similar Vulnerabilities
9.8
CVE-2026-28292
OS command injection in Simple Git Project
SP
Patch verified Public Exploits:1EPSS %1
9.8
CVE-2026-6951
Code injection in N/a Simple Git
N
Patch verified Public Exploits:1EPSS %1
8.1
CVE-2026-102826
simple-git allows command execution through unblocked Git configuration includes
S
Patch verifiedEPSS %0
9.2
CVE-2026-102828
simple-git unsafe-operation guard does not block trailer command configuration
S
Patch verifiedEPSS %0
8.1
CVE-2026-102827
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
S
Patch verifiedEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-28291"