Gitahead
Monthly
Command injection in GitAhead 2.7.1 and earlier on macOS allows an attacker to execute arbitrary shell commands as the victim user by placing a crafted filename containing a double quote and AppleScript payload into a repository and convincing the victim to select 'Show in Finder' on that file. The flaw requires user interaction (the victim must open an attacker-controlled repository and explicitly trigger the action) and affects only macOS; no public exploit code or active exploitation has been identified at time of analysis. The CVSS 4.0 score is 8.7 with a vector indicating network attack, no privileges required, and passive user interaction.
OS command injection in GitAhead through 2.7.1 lets a malicious repository execute arbitrary shell commands on the victim's machine during a routine checkout or staging operation, because crafted filenames are substituted unescaped into Git clean/smudge filter commands that GitAhead runs through 'bash -c'. The attack is remote and unauthenticated from the attacker's side (CVSS 4.0 vector PR:N) but high in complexity and gated on user interaction: the victim must clone or open an untrusted repository and then perform a checkout or stage, making it a conditional code-execution risk rather than a mass-exploitation event. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though the 7.7 base score and full confidentiality/integrity/availability impact justify prompt attention for anyone using the client with repositories of uncertain provenance.
Insecure automatic update handling in GitAhead 2.5.0 through 2.7.1 allows a network-positioned attacker to deliver and execute an attacker-supplied update binary with the privileges of the victim user. The updater installs downloaded updates without integrity or signature verification (Updater.cpp:176-279), and the application permanently suppresses TLS certificate validation after the user accepts a single SSL error dialog (Application.cpp:284-309), so an attacker who presents an invalid certificate once can intercept later automatic update checks, offer a fake version, and achieve code execution when installation is approved. The CVSS 4.0 vector rates this 7.7 (AV:N/AC:H/AT:P/PR:N/UI:P) and the parallel CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H; unauthenticated remote attackers are in scope, but exploitation is conditional on a man-in-the-middle position and mandatory user interaction at both the certificate dialog and the install prompt, and no public exploit code has been identified at time of analysis.
Command injection in GitAhead 2.7.1 and earlier on macOS allows an attacker to execute arbitrary shell commands as the victim user by placing a crafted filename containing a double quote and AppleScript payload into a repository and convincing the victim to select 'Show in Finder' on that file. The flaw requires user interaction (the victim must open an attacker-controlled repository and explicitly trigger the action) and affects only macOS; no public exploit code or active exploitation has been identified at time of analysis. The CVSS 4.0 score is 8.7 with a vector indicating network attack, no privileges required, and passive user interaction.
OS command injection in GitAhead through 2.7.1 lets a malicious repository execute arbitrary shell commands on the victim's machine during a routine checkout or staging operation, because crafted filenames are substituted unescaped into Git clean/smudge filter commands that GitAhead runs through 'bash -c'. The attack is remote and unauthenticated from the attacker's side (CVSS 4.0 vector PR:N) but high in complexity and gated on user interaction: the victim must clone or open an untrusted repository and then perform a checkout or stage, making it a conditional code-execution risk rather than a mass-exploitation event. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though the 7.7 base score and full confidentiality/integrity/availability impact justify prompt attention for anyone using the client with repositories of uncertain provenance.
Insecure automatic update handling in GitAhead 2.5.0 through 2.7.1 allows a network-positioned attacker to deliver and execute an attacker-supplied update binary with the privileges of the victim user. The updater installs downloaded updates without integrity or signature verification (Updater.cpp:176-279), and the application permanently suppresses TLS certificate validation after the user accepts a single SSL error dialog (Application.cpp:284-309), so an attacker who presents an invalid certificate once can intercept later automatic update checks, offer a fake version, and achieve code execution when installation is approved. The CVSS 4.0 vector rates this 7.7 (AV:N/AC:H/AT:P/PR:N/UI:P) and the parallel CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H; unauthenticated remote attackers are in scope, but exploitation is conditional on a man-in-the-middle position and mandatory user interaction at both the certificate dialog and the install prompt, and no public exploit code has been identified at time of analysis.