OS Command Injection Vulnerability in GitAhead by GitAhead Inc.
CVE-2026-106058

7.7HIGH

Key Information:

Vendor

Gitahead

Status
Gitahead
Vendor
CVE Published:
7 October 2026

What is CVE-2026-106058?

GitAhead, a version control tool, through version 2.7.1, is susceptible to an OS command injection vulnerability. This issue allows attackers to craft malicious filenames and exploit clean/smudge filter commands to execute arbitrary commands on the victim's system. By manipulating .gitattributes files, an attacker can craft repository files that, when processed during checkout or staging, may trigger execution of commands through bash -c, posing a significant security risk to users.

Affected Version(s)

gitahead 0 <= 2.7.1

References

https://github.com/gitahead/gitahead/issues/661
issue-tracking
https://github.com/gitahead/gitahead
product
https://github.com/gitahead/gitahead/blob/v2.7.1/src/git/...
technical-description

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

M.J Dhurgesh
.