# simple-git unsafe-operation guard does not block trailer command configuration

simple-git's default unsafe-operation guard omits trailer.<token>.cmd from its blocklist, letting attacker-controlled config reach git interpret-trailers and execute shell commands as the Node process.

- Payout: Research
- Severity: critical
- Program: simple-git
- Found by: sec-reex
- Disclosed: 2026-10-05
- CVE: CVE-2026-102828
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-x6jw-m9v5-85vh
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-x6jw-m9v5-85vh
- Tags: area:oss domain:oss impact:rce kind:research platform:ghsa sev:critical tech:nodejs technique:incomplete-fix technique:source-review vuln:command-injection vuln:rce

**Target:** npm library simple-git / git interpret-trailers config handling
**Root cause:** blockUnsafeOperationsPlugin's preventUnsafeConfig list in @simple-git/argv-parser has no matcher for trailer.<token>.cmd, so commandConfigPrefixingPlugin's -c key=value passes through unblocked to Git, which treats the value as a shell command.
**Steps:**
1. Control: set `core.editor=<test-helper>` via SimpleGitOptions.config; default plugin throws GitPluginError before spawning Git.
2. Bypass: set `trailer.audit.cmd=<test-helper>` via the same option.
3. Invoke git with argv shape `git -c trailer.audit.cmd=<test-helper> interpret-trailers --trailer audit:<value> <input-file>`.
4. No GitPluginError raised; Git invokes the helper while processing the trailer.
**How found:** Code review of git-factory.ts plugin ordering (prefixing before unsafe-operation guard) and the argv-parser preventUnsafeConfig list, noticing trailer.<token>.cmd absent while Git docs describe it as a shell command.
**Exploitation:** Attacker who controls values reaching SimpleGitOptions.config or inline -c arguments supplies trailer.<token>.cmd=<command>; when the app runs git interpret-trailers, Git executes the command with the Node.js process's OS identity and permissions.
**Insight:** When a library blocklists dangerous config keys, enumerate the target tool's full config namespace for keys whose values are executed (editors, pagers, hooks, trailer commands, diff drivers) rather than trusting the existing list; plugin ordering that rewrites argv before validation means the validator sees the final -c form.