CVE-2026-47191
LowCVSS 2.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to verify repository integrity, users may be tricked into checking out a branch of the same name from a compromised repository. This primarily affects SHA-256 commit IDs, as SHA-1 may be vulnerable to hash collisions.
Risk Assessment
The risk is the possibility of checking out a malicious branch instead of the intended commit, which could lead to injection of dangerous code into the project. The attack requires the repository to be taken over by an attacker, but if that happens, code integrity is compromised.
Recommendation
Upgrade to kas version 5.3 or later. As a workaround, avoid relying solely on the commit ID for integrity validation; additionally validate cryptographically signed commits or tags, or use a secure mirror of the repository.
Original NVD description (English source)
kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the referenced repository has been taken over by an attacker and modified to carry such a branch. SHA-1 commits may also be replaced by creating hash collisions, so the primary impact of this issue is on SHA-256 commit IDs. Version 5.3 fixes the issue. As a workaround, avoid relying solely on the commit ID for integrity validation of a repository that might become under control of a malicious 3rd party. If available, additional validate cryptographically signed commits or tags. Alternatively, mirror the repository to a save place, validate its integrity, and use this instead of the original one.