CVE-2026-106058
Received Received - Intake

GitAhead OS Command Injection via Malicious Repository

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: VulnCheck

Description
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $(command) selected via .gitattributes so checkout or staging runs the command through bash -c as the victim.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-106058
EUVD
EUVD-2026-94306

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gitahead gitahead 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GitAhead through version 2.7.1 has an OS command injection flaw in its Git filter handling. When processing files during checkout or staging, it executes shell commands using user-controlled filenames without proper escaping. Attackers can craft filenames with $(command) syntax in .gitattributes to run arbitrary commands via bash -c as the victim.

Detection Guidance

Check GitAhead version with 'gitahead --version' or inspect installed binaries. Look for repositories with .gitattributes files containing filter commands using %f placeholder. Monitor for unexpected command execution during git checkout, clone, or staging operations.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on your system with your privileges. Successful exploitation could lead to data theft, file modification, credential compromise, or further system compromise. It requires user interaction during normal Git operations like checkout or staging.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using GitAhead may face compliance violations if exploited.

Mitigation Strategies

Upgrade to the latest GitAhead version if available. Avoid using Git clean/smudge filters with %f placeholder. Disable shell execution in filter commands. Use Git filter-process protocol instead of shell-based filters. Review and remove untrusted repositories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106058. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart