CVE-2026-106058 — GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filena…
Published: 2026-10-07 · CVSS: 7.7 · CVSS 4.0
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $(command) selected via .gitattributes so checkout or staging runs the command through bash -c as the victim.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7