CVE-2026-106059: GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do shell script payload, which runs as the victim user when Show in Finder is chosen.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
GitAhead users on macOS are exposed when they open a repository containing an attacker-controlled filename and choose Show in Finder for that path. The injected command runs with the privileges of the victim user.
What must an attacker do to exploit it?
An attacker must craft and commit a file whose path includes a double quote followed by a do shell script payload. They also need to persuade the victim to interact with that path using GitAhead's Show in Finder action.
Is user interaction required?
Yes. The victim must choose Show in Finder; the provided data does not indicate that merely cloning or opening the repository triggers execution.
How can I identify a potentially malicious repository?
Inspect repository filenames and paths for unexpected double quotes and AppleScript text such as do shell script. Treat repositories containing such attacker-controlled paths as suspicious, particularly before using Show in Finder.