What’s Vulnerable › Vulnerabilities

CVE-2026-106058: GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-07 · updated 2026-10-07
• Weakness: CWE-78

Description

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $(command) selected via .gitattributes so checkout or staging runs the command through bash -c as the victim.

Affected products

• gitahead: through 2.7.1

References

• https://github.com/gitahead/gitahead
• https://github.com/gitahead/gitahead/blob/v2.7.1/src/git/Filter.cpp#L43-L70
• https://github.com/gitahead/gitahead/issues/661
• https://www.vulncheck.com/advisories/gitahead-through-2.7.1-os-command-injection-via-git-filter-filenames
• https://github.com/gitahead/gitahead/issues/661

Get alerted when CVE-2026-106058 or the next vulnerability affects your stack