CVE-2026-106058: GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $(command) selected via .gitattributes so checkout or staging runs the command through bash -c as the victim.
Affected Software
Event History
Frequently Asked Questions
Which user actions can trigger exploitation?
Checking out or staging content from a malicious repository can trigger the vulnerable clean or smudge filter handling. Exploitation requires the victim to perform one of those actions.
What must an attacker provide to exploit this issue?
The attacker needs to supply a malicious repository containing crafted filenames and a .gitattributes configuration that selects the relevant filter. The crafted filename is substituted into a clean or smudge filter command and executed through bash -c.
Who is exposed?
Users of GitAhead through 2.7.1 are exposed when they interact with attacker-controlled repositories, particularly during checkout or staging. The attacker does not need prior privileges, but victim interaction is required.
How can I determine whether my installation is affected?
Installations running GitAhead 2.7.1 or earlier fall within the reported affected range. Repositories that use .gitattributes to apply clean or smudge filters to suspiciously named files warrant particular scrutiny.