The simple-git library contains an OS command injection vulnerability that permits unauthenticated remote code execution due to an incomplete blocklist implementation.

This vulnerability is an OS command injection (CWE-78) flaw where the application fails to properly sanitize Git command options. An unauthenticated attacker can manipulate command strings to include restricted flags, bypassing regular expression filters to execute arbitrary commands on the underlying host.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the application process. This could lead to full system compromise, unauthorized data exfiltration, or lateral movement within the network. With a CVSS score of 8.1, this is a high-severity issue that represents a significant risk to the integrity and availability of any infrastructure utilizing this library.

Immediate Action: Update the simple-git package to version 3.32.0 or later immediately to incorporate the necessary security hardening.

Proactive Monitoring: Monitor server logs for unexpected process spawns or Git commands containing unusual flag combinations, such as combined characters like -vu or -4u.

Compensating Controls: Implement strict input validation at the application layer to ensure that only expected and safe Git commands are passed to the library, effectively whitelisting permitted operations.

Public Exploit Available: Unknown

Given the potential for remote code execution and the existence of proof-of-concept data, organizations should prioritize patching this dependency. Ensure that all development environments and production systems are upgraded to version 3.32.0 to remediate the underlying command injection vector permanently.