GitAhead EUVD-2026-92159

Exploitation requires the attacker to hold a man-in-the-middle position on the network path during GitAhead's automatic update check, and the victim must (1) dismiss/accept the single SSL error dialog at least once - after which TLS errors are permanently ignored for later checks - and (2) approve installation of the attacker-supplied update. The specific weaknesses are the updater installing downloaded updates without integrity or signature verification (Updater.cpp:176-279) and the application permanently suppressing TLS validation after one SSL error (Application.cpp:284-309). Limiting factors: only GitAhead versions 2.5.0 through 2.7.1 are affected, the attacker must be positioned in the network path (not purely remote/internet-wide), user interaction is mandatory for both the TLS dialog and the install step, and the product is discontinued with a small user base.

This is a genuine but conditional supply-chain-style risk rather than a mass-exploitable critical flaw. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P, score 7.7) is internally consistent with the description: exploitation is unauthenticated (PR:N) but requires a privileged network position plus specific attack conditions (AC:H, AT:P) and passive user interaction (UI:P) - the victim must accept the one-time SSL dialog and then approve installation of the offered update. No EPSS score was provided, GitAhead is not on CISA KEV, and no POC or exploit code is referenced in the sources, so the signals point to a theoretically high technical impact (full code execution: VC:H/VI:H/VA:H) gated behind real-world preconditions that limit widespread automated exploitation. Note two caveats: the input Tag labels this as 'Information Disclosure', which conflicts with CWE-494 and the described code-execution impact - the integrity/availability consequence is primary, not confidentiality. Also, GitAhead is a discontinued/archived Git GUI client, so even though the flaw is serious for affected users, the real-world exposed population is small.

An attacker on the same network path as a GitAhead user (e.g. shared Wi-Fi, compromised router, or ARP/DNS spoofing) intercepts the application's automatic update check and presents an invalid TLS certificate; once the user clicks through the single SSL error dialog, the client permanently ignores TLS errors for subsequent checks. The attacker then serves a fake 'newer' version which GitAhead downloads and installs without any signature or integrity verification, and arbitrary code runs with the user's privileges when the update is applied. No public exploit code is identified at time of analysis, though the vulnerable code paths are explicitly cited in the advisory.