CVE-2025-8110

CVE-2025-8110 — Gogs RCE PoC Silentium / HackTheBox Предупреждение: Этот инструмент предназначен строго для образовательных целей и авторизованного тестирования на проникновение. Используйте его только против систем, на тестирование которых у вас есть явное разрешение. Это модифицированная версия...

CVE-2025-8110

Эксплойт Gogs RCE CVE-2025-8110 Доказательство концепции PoC для CVE-2025-8110 , критической уязвимости в Gogs, которая позволяет выполнять удалённый код RCE через манипуляции с .git/config с помощью обхода символических ссылок и инъекции sshCommand. 📖 Обзор Этот эксплойт нацелен на недостаток Pa...

CVE-2022-23642

Sourcegraph Gitserver 3.37.0 RCE에 대한 PoC CVE-2022-23642 Sourcegraph 3.37.0 이전 버전에는 gitserver 서비스에 원격 코드 실행 취약점이 있습니다. 이는 git config 실행에 대한 제한이 없기 때문에 발생하며, 따라서 HTTP 인수에 "core.sshCommand"를 전달할 수 있고, 여기에는 임의의 bash 명령이 포함될 수 있습니다. 이 취약점은 gitserver가 공격자에게 노출된 경우에만 가능합니다. 이는 Sourcegraph 3.36.3에서...

CVE-2025-8110

Gogs RCE Exploit CVE-2025-8110 Доказательство концепции для CVE-2025-8110 — удалённое выполнение кода в Gogs через обход символической ссылки и внедрение sshCommand. Описание Этот эксплойт использует обход символической ссылки в API Gogs, чтобы перезаписать .git/config и внедрить вредоносный...

CVE-2025-8110-Gogs-RCE-Exploit

Gogs CVE-2025-8110 RCE Exploit Автоматизированный Python-эксплойт для CVE-2025-8110 в Gogs. Эта уязвимость позволяет выполнять удаленный код RCE путем злоупотребления API PutContents, который не проверяет, является ли путь к файлу символической ссылкой. Перезаписывая внутренний файл .git/config...

CVE-2025-65964

n8n Git Hooks CTF Демо ⚠️ Этот репозиторий предназначен только для образовательных целей и демонстрации CTF. Сценарий Платформа автоматизации например, n8n использует операции Git в рамках рабочего процесса. Рабочий процесс позволяет произвольную конфигурацию Git через git config. Управляемый...

guardskill

GuardSkill A repository can make your coding agent run code the moment it opens the folder. GuardSkill checks for that before you do. npx guardskill . Read-only. No network calls, no telemetry, no configuration, no account, no dependencies. It reads git configuration and hook scripts, prints what...

Exploit for CVE-2026-71963

CVE-2026-71963 — Hermes Agent RCE via a repository-delivered...

CVE-2025-8110-Silentium-HTB

CVE-2025-8110 — PoC de RCE en Gogs Silentium / HackTheBox Aviso: Esta herramienta está destinada exclusivamente a fines educativos y pruebas de penetración autorizadas. Úsela solo contra sistemas en los que tenga permiso explícito para probar. Esta es una versión modificada de...

ansible-core security update

2.16.3-4 - Fix CVE-2026-11332 ansible-galaxy role installs could allow arbitrary git configuration injection via malformed role requirements RHEL-194126...

Oracle Linux 8 : ELSA-2026-66248-0: / ansible-core (ELSA-2026-662480)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-662480 advisory. 2.16.3-4 - Fix CVE-2026-11332 ansible-galaxy role installs could allow arbitrary git configuration injection via malformed role requirements RHEL-194126 Tenab...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

ROS-20260908-73-0094

The vulnerability of the GitConfigParser.read function in the git/config.py module of the Python library for interacting with Git repositories in GitPython is related to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to execute arbitra...

gitpython: GitPython: Arbitrary code execution via config-name injection

A flaw was found in GitPython. This vulnerability allows attackers to inject malicious configuration options by manipulating option names within the option-name validator. By injecting special characters, an attacker can forge arbitrary git-config directives, potentially leading to arbitrary code...

CVE-2026-71963

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user...

EUVD-2026-70526

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user...

CVE-2026-71963 Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user...

CVE-2026-71963 Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user...

CVE-2026-71963

Hermes Agent versions 0.18.2 through 0.21.0 are vulnerable to remote code execution via a crafted .git/config file in a malicious repository. The agent executes git status or git diff before trust prompts are presented to the user; by setting core.fsmonitor to an attacker-controlled command, an a...

CVE-2026-85168

n8n versions before 1.123.73 , 2.35.4 , and 2.36.2 are affected by a remote code execution vulnerability in the Git node . The root cause is that the node's sanitization logic reset a fixed list of command-bearing Git configuration keys but did not cover the content-filter and merge-driver key fa...