CVE-2026-106058

Summary

GitAhead allows attackers to inject OS commands through crafted filenames in git filters, enabling arbitrary command execution when victims check out or stage files from malicious repositories.

Exploitability

Exploitation requires a victim to checkout or stage files from a malicious repository with specially crafted .gitattributes configuration, making it moderately difficult but possible with social engineering.

Blast radius

The vulnerability could impact any GitAhead user who checks out or stages files from compromised repositories, potentially leading to full system compromise through command injection.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to GitAhead 2.7.2 or later to address this OS command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.