@stackflag.bsky.socialCVE-2026-102829 - git-js
The @simple‑git/argv-parser library used by simple‑git does not treat the VISUAL environment variable as a risky editor setting. Because VISUAL is dropped before safety checks,…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-102828 - git-js
The simple-git library does not block a special Git setting called trailer.<token>.cmd, which can run shell commands. If an application passes untrusted data into simple-git’s…
Too many irrelevant or confusing CVEs? Use stackflag.com