GitAhead EUVD-2026-94307

Exploitation requires that the victim run GitAhead (version ≤2.7.1) on macOS, open/clone a repository under attacker control containing a file whose path includes a double quote plus an AppleScript do shell script payload, and then actively invoke the 'Show in Finder' action on that file - this user interaction (UI:P) is the primary limiting factor. The root cause is unescaped interpolation of the repository filename into the Show in Finder AppleScript (ShowTool.cpp). No application authentication is required (PR:N), and the default build is vulnerable, but the flaw cannot trigger without the victim's deliberate menu action and does not affect non-macOS platforms since it relies on AppleScript.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, score 8.7) is internally consistent with the description: an attacker needs no authentication to GitAhead and no special conditions, but exploitation is gated by passive user interaction (UI:P) - the victim must choose 'Show in Finder' on an attacker-controlled file. This is a classic 'malicious repository' client-side vector rather than a remotely-triggerable server flaw, so real-world risk depends on social engineering (getting a developer to clone a hostile repo and interact with it). No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or automated weaponization; the technical impact is high (arbitrary shell execution as the victim user) but the delivery is user-dependent and the product is a discontinued niche developer tool. Net assessment: a genuine high-severity code-execution bug worth patching/migrating off GitAhead for affected macOS users, but not a mass-exploitation emergency - closer to a targeted-threat profile given the user-interaction requirement and absence of exploitation telemetry. Note the AT:N/AV:N combination describes network-origin malicious content, not a network service; verify this framing matches how your environment distributes repositories.

An attacker publishes or contributes to a Git repository containing a file whose path embeds a double quote followed by a do shell script AppleScript payload. A macOS victim clones or opens that repository in GitAhead (through 2.7.1) and selects 'Show in Finder' on the file, causing the unescaped path to break out of the AppleScript string and execute arbitrary shell commands as the victim user. No public exploit was identified in the provided data, but the technique is fully described in the VulnCheck advisory and the vulnerable code is pinpointed in ShowTool.cpp.