Arbitrary Code Execution Vulnerability in TruffleHog by Truffle Security Co.
CVE-2025-41390

7.8HIGH

Key Information:

Vendor

Truffle Security Co.

Status
Trufflehog
Vendor
CVE Published:
20 October 2025

What is CVE-2025-41390?

An arbitrary code execution vulnerability affects TruffleHog 3.90.2 by Truffle Security Co. This vulnerability is exploited when an attacker provides a specially crafted repository that can execute arbitrary code upon processing. It poses a significant risk to users who may inadvertently interact with compromised repositories. Users are advised to apply necessary security measures and updates to mitigate potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

TruffleHog 3.90.2

References

https://talosintelligence.com/vulnerability_reports/TALOS...
https://trufflesecurity.com/blog/contributor-spotlight-ad...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Reiser of Cisco ASIG
JSON
.