CVE-2026-106059
HighCVSS 8.8Summary
GitAhead through version 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames. Attackers can commit a file whose path contains a double quote and a payload, which runs when 'Show in Finder' is selected.
Risk Assessment
A user could be tricked into executing malicious code on their account, potentially leading to system compromise or data theft.
Recommendation
Update GitAhead to a version newer than 2.7.1 that includes a fix for this vulnerability.
Other vulnerabilities in GitAhead
See all- CVE-2026-106058High
GitAhead through version 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $(command) selected via .gitattributes so checkout or staging runs the command through bash -c as the victim.
- CVE-2026-105295High
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. A network attacker presenting an invalid certificate once can intercept later automatic update checks, offer a fake version, and execute code as the user upon installation.
Original NVD description (English source)
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do shell script payload, which runs as the victim user when Show in Finder is chosen.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS