CVE-2026-109318

Summary

Grav Git Sync contains a command injection vulnerability in versions 1.0.2 through 3.4.12 that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. This occurs when git commit --author is used with malicious input, running commands as the web-server account.

Exploitability

Exploitation requires an authenticated content editor account with author mode enabled, making it moderately difficult but possible to achieve with a low-privileged user.

Blast radius

If exploited, attackers could execute arbitrary OS commands as the web-server account, potentially leading to full server compromise and data exfiltration.

Detection

Monitor for unusual git commit author fields in repository logs, particularly those containing shell metacharacters like semicolons or pipes, and watch for unexpected process execution patterns from the web server account.

Prioritized remediation

Upgrade to Grav Git Sync version 3.4.13 or later to remediate this command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.