high7.5
CVE-2026-106058
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substitut…
Impact
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $(command) selected via .gitattributes so checkout or staging runs the command through bash -c as the victim.
Affected products
| Product | Affected versions |
|---|---|
| GitAhead | through 2.7.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.