HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-106058 — GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git...

·Source: NIST NVD

Updated:

Executive Summary

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $(command) selected via .gitattributes so checkout or staging runs the command through bash -c as the victim.

Analysis

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $(command) selected via .gitattributes so checkout or staging runs the command through bash -c as the victim. CVSS Score: 7.5. Published: 2026-10-07T12:17:08.920.

Indicators of Compromise (1)

CVE (1)
CVE-2026-106058
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 7, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience

An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience.

Dark Reading
CRITICALVulnerabilityNEW

F5 releases out-of-band patches for critical NGINX vulnerabilities

F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. [...]

BleepingComputer
MEDIUMVulnerability

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

Threat actors have been observed delivering cryptocurrency miners and proxy software. The post Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure appeared first on SecurityWeek .

SecurityWeek