CVE-2026-106059

Summary

GitAhead through 2.7.1 on macOS allows attackers to execute shell commands by crafting repository filenames, posing a significant risk due to the high privilege level of the victim user.

Exploitability

Exploitation is relatively straightforward as attackers can commit a file with a payload that runs when the Show in Finder feature is used, requiring only basic knowledge of crafting filenames and shell scripts.

Blast radius

If exploited, this vulnerability could lead to full system compromise, as the commands run with the victim user's privileges, potentially allowing attackers to gain control over the affected macOS system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to GitAhead 2.7.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.