https://seclists.org/oss-sec/2026/q4/394: CVE-2026-112818: git-annex cross-pository data exfiltration
Published Oct 26, 2026
·Updated
Affected Software
1 affected component
git-annex git-annex<10.20261026
git-annex 10.20261026 includes the fix. Backported patches are available in branches named CVE-2026-112818-patch-10.20250416, CVE-2026-112818-patch-10.20251029, and CVE-2026-112818-patch-10.20261006.
In the described attack, initializing git-annex in a clone autoenables an attacker-controlled special remote. This means the victim does not need to manually enable that special remote for the simplest attack scenario.
The attacker must control one of the victim repository's remotes, such as by supplying a repository for the victim to clone. They also need information about annexed files present in the victim's private repository, such as files whose existence can be inferred from a published Git repository.