vulnerability · Mon 05 Oct 2026 · 23:48 UTC
GHSA-v5rq-49vh-5v5c: simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
Filed UTCSource GTH ↗
Security control bypass in @simple-git/argv-parser: Git's VISUAL editor fallback is not classified as allowUnsafeEditor ## Report metadata | Field | Value | | --- | --- | | Package | @simple-git/argv-parser (npm, pkg:npm/%40simple-git/argv-parser) | | Repository | https://github.com/steveukx/git-js | | Component | parseEnv (packages/argv-parser/src/env/parse-env.ts), reached via vulnerabilityCheck(tokens, env) | | Vulnerability class | Security-control bypass — incomplete denylist in unsafe-editor detection | | Verified against | c427fbad33f1f2b11341f1cf852eedecbb106400 (`@…
Signals
as the pipeline stamped them- High
- Critical vulnerability
- What to do
- Critical severity — schedule an urgent patch.
CVE
KEV from CISA · EPSS from FIRST| Id | KEV | EPSS | Reference |
|---|---|---|---|
| CVE-2026-102829 | — | 0.27% | NVD ↗ |
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.