CVE-2026-106058: high-severity vulnerability in gitahead
GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames
Published
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7
exploitation probability
—
observed exploitation
nono source reports it
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $(command) selected via .gitattributes so checkout or staging runs the command through bash -c as the victim.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
gitahead · gitaheadRelated CVEs — gitahead
In the same product, most dangerous first.