CVE-2026-106059 — GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescape…
Published: 2026-10-07 · CVSS: 8.7 · CVSS 4.0
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do shell script payload, which runs as the victim user when Show in Finder is chosen.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7