{"id":"CVE-2026-106058","published":"2026-10-07T12:17:08.920","lastModified":"2026-10-07T21:17:12.053","description":"GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $(command) selected via .gitattributes so checkout or staging runs the command through bash -c as the victim.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/gitahead/gitahead","tags":[]},{"url":"https://github.com/gitahead/gitahead/blob/v2.7.1/src/git/Filter.cpp#L43-L70","tags":[]},{"url":"https://github.com/gitahead/gitahead/issues/661","tags":[]},{"url":"https://www.vulncheck.com/advisories/gitahead-through-2.7.1-os-command-injection-via-git-filter-filenames","tags":[]},{"url":"https://github.com/gitahead/gitahead/issues/661","tags":[]}],"exploitRefs":[{"url":"https://github.com/gitahead/gitahead","tags":[]},{"url":"https://github.com/gitahead/gitahead/blob/v2.7.1/src/git/Filter.cpp#L43-L70","tags":[]},{"url":"https://github.com/gitahead/gitahead/issues/661","tags":[]},{"url":"https://github.com/gitahead/gitahead/issues/661","tags":[]}],"hasPoc":true,"ai":{"summary":"GitAhead allows attackers to inject OS commands through crafted filenames in git filters, enabling arbitrary command execution when victims check out or stage files from malicious repositories.","exploitability":"Exploitation requires a victim to checkout or stage files from a malicious repository with specially crafted .gitattributes configuration, making it moderately difficult but possible with social engineering.","blast_radius":"The vulnerability could impact any GitAhead user who checks out or stages files from compromised repositories, potentially leading to full system compromise through command injection.","remediation":"Upgrade to GitAhead 2.7.2 or later to address this OS command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","git","command-injection"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:03:46.613Z"}}