git-secrets

=========== git-secrets パスワードやその他の機密情報をgitリポジトリにコミットするのを防ぎます。 .. contents:: :depth: 2 概要 :: git secrets --scan -r|--recursive --cached --no-index --untracked ... git secrets --scan-history git secrets --install -f|--force git secrets --list --global git secrets --add -a|--allowed -l|--literal...

GitBackdorizer

GitBackdorizer BETA GitBackdorizer is a proof of concept, fully inspired in Ulisses Castro's 50 ton of backdoors talk, that abuses the lack of user attention to steal git access credentials. How it Works GitBackdorizer consists of three pieces: handler, dropper and the payload. Handler The handle...

CVE-2021-21300

CVE-2021-21300 git多个版本中，对符号链接处理不严格。在大小写敏感（例如Linux）的文件系统上传文件到git后，使用大小写不敏感文件系统（例如Windows）的主机克隆恶意 仓库时可能导致远程命令执行 。 受影响版本 从 2.15 至 现有的 2.30.1 解决方案 1、升级版本 2、如下 禁用git 的symlink： git config --global core.symlinks false 禁用 process filter 通常是 LFS 使用此功能，可以通过 git config --show-scope --get-regexp...

Gitea-Git-Hooks-RCE-CVE-2020-14144-

Gitea Gitフック RCE CVE-2020-14144 OffsecProvingGrounds Practice — Roquefort マシンの Writeup & POC 概要 項目| 詳細 ---|--- マシン| Roquefort Proving Grounds Practice OS| Linux Gitea バージョン| 1.7.5 CVE| CVE-2020-14144 ベクター| Gitフック経由の認証済みRCE ユーザーシェル| chloe Gitea バージョン 1.1.0 → 1.12.5 では、 「May create git hooks」...

CVE-2020-14144-GiTea-git-hooks-rce

CVE-2020-14144 - GiTea 認証済みRCE gitフックを使用してCVE-2020-14144 - GiTea認証済みリモートコード実行を悪用するスクリプト 特徴 IPとPORTからの自動リバースシェルペイロード生成 カスタムシェルスクリプトをアップロードし、-f オプションでリモート実行 ユーザー名とパスワードによる自動ログイン 使用方法 $ ./CVE-2020-14144-GiTea-git-hooks-rce.py -h / | CVE-2020-14144 | | | | | | | | | | |/ / | Authenticated Remote Code...

CVE-2025-8110-Gogs-Remote-Code-Execution

受影响软件：Gogs（自托管Git服务）0.13.0版本之前。 漏洞类型：Git钩子机制中的命令注入。 描述：拥有仓库推送权限的攻击者可以构造恶意的Git钩子，将命令注入到post-receive钩子脚本中，从而导致在Gogs服务器上远程执行代码。...

CVE-2024-10220-githooks

CVE-2024-10220 テスト 参照 https://irsl.medium.com/sneaky-write-hook-git-clone-to-root-on-k8s-node-e38236205d54...

CVE-2026-52813-Gogs-RCE

CVE-2026-52813 — Gogs パストラバーサルによる Git Hooks リモートコード実行（防御視点の分析） セキュリティ研究 / ブルーチーム向け writeup。本リポジトリは兵器化された PoC を含みません 。 再現を希望する研究者は、公式 advisory が参照する公開 PoC をご利用ください。 項目| 内容 ---|--- CVE| CVE-2026-52813 エイリアス| GHSA-c39w-43gm-34h5 / GO-2026-5305 影響を受けるバージョン| Gogs /）と組み合わせることで、別のリポジトリのローカルチェックアウト内に悪意のあ...

CVE-2025-65964

n8n Git Hooks CTF Demo ⚠️ This repository is for educational and CTF demonstration purposes only. Scenario An automation platform e.g., n8n uses Git operations as part of a workflow. The workflow allows arbitrary Git configuration via git config. An attacker-controlled workflow sets:...

CVE-2026-60004-PoC

CVE-2026-60004: Gitea Diffpatch API リモートコード実行 !WARNING このリポジトリは、認可されたセキュリティ研究および管理されたラボ環境でのテストのみを目的としています。 所有していないシステム、または評価の明示的な許可を得ていないシステムに対して 概念実証を実行しないでください。 概要 CVE-2026-60004 は、Gitea の diffpatch API における重大なリモートコード実行脆弱性です。 リポジトリの作成または書き込み権限を持つ認証済みユーザーは、細工されたパッチを送信することで、 一時的なベアリポジトリ内に実行可能な Gi...

CVE-2026-78677

A flaw was found in GitPython. This vulnerability allows a remote attacker to create arbitrary Git directories outside the intended clone destination. By manipulating the separategitdir parameter during repository cloning, an attacker can redirect repository metadata to an attacker-controlled...

CVE-2026-93993: Inclusion of Functionality from Untrusted Control Sphere

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user...

CVE-2026-86320 Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

CVE-2026-86320: Improper Control of Generation of Code

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

gitpython: GitPython: Remote Code Execution via malicious Git hooks

A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the Repo.init function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on...

CVE-2026-19590

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlle...

EUVD-2026-69393

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlle...

CVE-2026-19590

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlle...

CVE-2026-19590

OpenAI Codex Desktop for Windows and macOS is vulnerable to arbitrary code execution due to a lack of proper sanitization of configuration settings. Specifically, automated Git operations trust the repository's local core.hooksPath setting. An attacker can provide a specially crafted repository w...

CVE-2026-19590

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlle...