Summary
A command-injection vulnerability in simple-git can allow attacker-influenced Git push arguments to bypass the library's unsafe-operation checks. When an application exposes controllable push options and uses a local, file-based, or attacker-influenced receive-pack target, Git may invoke an attacker-selected command.
Affected context
The issue occurs in simple-git applications that expose Git push arguments to untrusted or insufficiently validated input. The default protection compares parsed option names with specific dangerous spellings, while Git also accepts unambiguous long-option abbreviations; this mismatch can leave the push path insufficiently protected.
Exploit preconditions
- Attack surface: Application functionality that constructs or forwards simple-git push arguments
- Required access: Ability to influence relevant push options or the receive-pack target through an exposed application input
- Trigger point: Execution of a Git push operation using the attacker-influenced arguments
- Why exploitation is possible: Git accepts unambiguous abbreviated long options, but the defensive plugin checks only literal dangerous option names, allowing certain options to bypass filtering
Why this happens
The underlying flaw is incomplete validation of command-line options. The protection logic relies on exact string comparisons for dangerous Git options, while the Git command-line parser permits unambiguous abbreviations of those options. This inconsistent interpretation allows a semantically dangerous argument to evade filtering and reach Git, mapping to CWE-77: Improper Neutralization of Special Elements used in a Command and CWE-88: Improper Neutralization of Argument Delimiters in a Command.
Potential impact
- An attacker may cause execution of an attacker-selected command in the consuming application context
- The application process or host may be compromised
- Repository contents or credentials available to the process could be exposed
- Integrity of local repositories or downstream Git operations could be affected
- A compromised service may enable further lateral movement, depending on its privileges
General mitigation guidance
Mitigation generally focuses on removing ambiguity from command construction and treating all Git options supplied through application inputs as untrusted.
Common defensive patterns include:
- Prefer structured Git APIs or narrowly defined operation-specific wrappers over pass-through argument interfaces
- Apply allowlists for permitted push options and reject abbreviations, unexpected option forms, and extra arguments
- Validate and canonicalize arguments consistently with the target Git parser before security checks
- Keep repository URLs, receive-pack settings, and executable-related options under trusted application control
- Run Git operations with least-privilege identities, isolated working directories, and restricted filesystem and network access
- Avoid exposing raw command options through public request parameters or other attacker-controlled interfaces
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis rules identifying user-controlled values passed into simple-git push option collections or command arguments
- Code review checks for exact-string filtering of Git options without normalization or rejection of abbreviations
- Tests that verify dangerous option families cannot be represented through alternate spellings or parser-supported abbreviations
- Policy enforcement that restricts Git subprocess arguments to an approved operation-specific allowlist
- Runtime monitoring for unexpected Git child processes, receive-pack targets, or command execution initiated by application services
Automated code-review and dependency-analysis tools may help identify unsafe command construction patterns, but application-specific data-flow review remains important.
