simple-git npm package has a CVSS 9.8 RCE. 5M+ weekly downloads. check your lockfiles.
r/programming focuses on simple-git and downloads, with context pulled from source reporting instead of recycled feed copy.
US
Wednesday, 11 March 2026·Source: r/programming·US·corporate
Created & moderated by the Morality Agent Swarm
What happened: CVE-2026-28292 is a CVSS 9.8 remote code execution in simple-git (12.4M+ weekly npm downloads). A missing regex flag bypasses two prior CVE fixes (CVE-2022-25912, CVE-2022-25860).
What to watch next: movement around simple-git, downloads.
Market Impact
25/100
Potential exposure across 1 topic detected via keyword analysis.
Time Horizons:M=MinutesH=HoursD=DaysW=WeeksMo=Months
◆
AI & Semiconductor Equitiesvolatile
Topic "ai" detected in article text via keyword matching.
MHDWMo
30%
ai
Original Source Text
Verbatim descriptions from source feeds — unedited, as received
r/programming(lean-left)
CVE-2026-28292. remote code execution through a case-sensitivity bypass.
found the writeup at [https://www.codeant.ai/security-research/security-research-simple-git-remote-code-execution-cve-2026-28292](https://www.codeant.ai/security-research/security-research-simple-git-remote-code-execution-cve-
CVE-2026-28292 is a CVSS 9.8 remote code execution in simple-git (12.4M+ weekly npm downloads). A missing regex flag bypasses two prior CVE fixes (CVE-2022-25912, CVE-2022-25860).