CVE-2026-105295: fallo de gravedad alta en GitAhead
GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.7epss 0.1%
probabilidad de explotación
0.1%top 98% de las CVE
explotación observada
noninguna fuente lo reporta
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic update checks, offer a fake version, and execute code as the user upon installation.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
gitahead · GitAheadReferencias
https://github.com/gitahead/gitaheadhttps://github.com/gitahead/gitahead/blob/v2.7.1/src/app/Application.cpp#L284-L309https://github.com/gitahead/gitahead/blob/v2.7.1/src/update/Updater.cpp#L176-L279https://github.com/gitahead/gitahead/issues/662https://www.vulncheck.com/advisories/gitahead-2.5.0-through-2.7.1-unverified-update-installation-and-tls-bypass