CVE-2026-3854-lab

Flagship Lab 001: Git プッシュオプションから RCE へ CVE-2026-3854 の背後にある公開文書化された脆弱性コンセプトに触発されたローカル Learning Lab および Research Lab。どちらの体験も、架空の Git サーバーである ForgeDock に対して実際の認証付き Git プッシュを使用します。Research Lab。 !CAUTION このプロジェクトは意図的に脆弱性を含んでいます。ローカルのみで実行してください。ポートをパブリックネットワークや共有ネットワークに公開しないでください。本番環境で使用しないでください。 !NO...

ghes-cve-scanner

GHES CVE スキャナー GitHub Enterprise Server GHES インスタンスが CVE-2026-3854 および CVE-2026-4821 の影響を受けるかどうかを検出します。 CVE の背景 CVE-2026-3854 CVSS 8.7 Git Push RCE — babeld コンポーネントは git push オプション内のセミコロンをサニタイズしないため、リモートコード実行が可能になります。 影響を受けるバージョン: メジャー| 影響範囲| 最小安全バージョン ---|---|--- 3.14.x| = 3.14.24| 3.14.25 3.15....

Exploit_CVE-2026-3854

ExploitCVE-2026-3854 CVE-2026-3854 は、GitHub.com および GitHub Enterprise Server におけるリモートコード実行（RCE）の脆弱性です。 この脆弱性は、以下のように git push コマンドにコマンドを注入することで悪用される可能性があります： root@kitploit: git push -o '' origin master この脆弱性の悪用を確認するには、push オプションに「;」が含まれる push 操作について、/var/log/github-audit.log を確認することをお勧めします。...

CVE-2026-3854

CVE-2026-3854: GitHub における X-Stat ヘッダーインジェクションによる RCE Wiz Research が GitHub.com および GitHub Enterprise Server の内部 git push パイプラインで発見した脆弱性の仕組みに関する実践的な概要。 注意 この資料は教育目的および攻撃的セキュリティ研究を目的としています。 この脆弱性は、サポートされているすべてのバージョンで GitHub によってすでに修正されています。 自分が所有していない環境、または書面による明示的な許可を得ていない環境に対して再現を試みないでください。...

EUVD-2026-64014

Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/shell.py...

CVE-2026-62676

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...

CVE-2026-62676 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...

CVE-2026-62676 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...

CVE-2026-58437

A flaw was found in Gitea. This vulnerability allows an attacker to manipulate repository visibility settings by leveraging specific Git push options. This could lead to unauthorized disclosure of repository information or unintended access control changes. Mitigation Mitigation for this issue is...

CVE-2026-58437 Repository Visibility Manipulation via Git Push Options

Repository Visibility Manipulation via Git Push Options...

CVE-2026-58437

CVE-2026-58437 affects Gitea: Git push options repo.private and repo.template can alter an existing repo’s visibility or template status when pushed by an admin/owner, bypassing standard audits and notifications. Affected code path in routers/private/hook_post_receive.go reads push options and, i...

CVE-2026-72770

CVE-2026-72770 affects n8n before 1.123.67. The Git node operations fetch, pull, and push-tags allow path traversal, bypassing repository-path containment checks. With workflow create/execute rights, an attacker can point allowlisted remote configurations at local paths outside the sandbox to pul...

GO-2026-6047 Gitea: Repository Visibility Manipulation via Git Push Options in gitea.dev

Gitea: Repository Visibility Manipulation via Git Push Options in gitea.dev...

Gitea: Repository Visibility Manipulation via Git Push Options

Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | Affected File | routers/private/hookpostreceive.go | | Affected Function | HookPostReceive | | Affected Lines | 173–225 | | Prerequisite | Attacker must have owner-level or admin collaborator access to t...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging through the processing of undocumented git push options in the HookPostReceive function. An attacker can change the visibility or template status of a repository without triggering audit logs, webhooks, or...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging through the processing of undocumented git push options in the HookPostReceive function. An attacker can change the visibility or template status of a repository without triggering audit logs, webhooks, or...

PT-2026-63303

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains an issue where the post-receive git hook handler incorrectly processes git push options on existing repositories. Users with owner or admin-collaborator access can use the...

CVE-2026-44938

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml or BundleDeployment.spec.options.namespaceLabels when applying them to the target namespace. An attacker with git push access to a Fleet-monitored...

EUVD-2026-42039

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml or BundleDeployment.spec.options.namespaceLabels when applying them to the target namespace. An attacker with git push access to a Fleet-monitored...

CVE-2026-44938 Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml or BundleDeployment.spec.options.namespaceLabels when applying them to the target namespace. An attacker with git push access to a Fleet-monitored...