Came across something in pnpm-lock.yaml around line 1 that looked worth flagging.
The simple‑git library (versions 3.15.0‑3.32.2) contains a command‑injection flaw that bypasses earlier CVE fixes, allowing an attacker to execute arbitrary commands on the host system. In version 3.30.0 the vulnerability is present, posing a critical remote‑code‑execution risk.
Something like this might fix it:
Upgrade simple‑git to version 3.32.3 or later. Edit package.json (e.g., change "simple-git": "^3.32.3") and run pnpm install to regenerate pnpm‑lock.yaml.
For reference: rule CVE-2026-28292. Rated critical.
I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
pnpm-lock.yamlaround line 1 that looked worth flagging.The simple‑git library (versions 3.15.0‑3.32.2) contains a command‑injection flaw that bypasses earlier CVE fixes, allowing an attacker to execute arbitrary commands on the host system. In version 3.30.0 the vulnerability is present, posing a critical remote‑code‑execution risk.
Something like this might fix it:
For reference: rule
CVE-2026-28292. Rated critical.I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.