64 matches found
CVE-2026-3854-lab
Flagship 实验室 001：从 Git 推送选项到 RCE 一个本地学习实验室和研究实验室，灵感来自 CVE-2026-3854 背后公开记录的漏洞概念。这两种体验都会对 ForgeDock（一个虚构的 Git 服务器）执行真实的经过身份验证的 Git 推送；即研究实验室。 !CAUTION 本项目故意包含漏洞。仅限本地运行。请勿将其端口暴露到公共或共享网络。切勿在生产环境中使用。 !NOTE 本仓库以只读教育参考资料的形式发布。不接受公开的 issue、拉取请求、功能请求或支持请求。请按照SECURITY.md 中的说明私下报告意外的安全边界缺陷。 选择体验 学习实验室...
ghes-cve-scanner
GHES CVE 扫描器 检测 GitHub Enterprise Server GHES 实例是否受 CVE-2026-3854 和 CVE-2026-4821 影响。 CVE 背景 CVE-2026-3854 CVSS 8.7 Git Push 远程代码执行 — babeld 组件未对 git push 选项中的分号进行清理，导致可远程执行代码。 受影响版本： 主版本| 受影响范围| 最低安全版本 ---|---|--- 3.14.x| = 3.14.24| 3.14.25 3.15.x| = 3.15.19| 3.15.20 3.16.x| = 3.16.15| 3.16.16...
Exploit_CVE-2026-3854
ExploitCVE-2026-3854 CVE-2026-3854 是 GitHub.com 和 GitHub Enterprise Server 中的一个远程代码执行漏洞。 该漏洞可通过向 git push 命令注入命令来利用，具体如下： git push -o '' origin master 若要审查该漏洞的任何利用行为，我们建议您检查 /var/log/github-audit.log 中推送操作里包含 ";" 的 push options。 受影响版本： GitHub Enterprise Server = 3.19.1 修复版本：...
CVE-2026-3854
CVE-2026-3854：通过 X-Stat 头注入在 GitHub 上实现 RCE 关于 Wiz Research 在 GitHub.com 和 GitHub Enterprise Server 的内部 git push 管道中发现该漏洞的实用摘要。 警告 本材料仅供教育和进攻性安全研究之用。 该漏洞已在所有受支持的版本中被 GitHub 修复。 请勿尝试针对非您所有或未经您书面明确授权的环境进行复现。未经授权访问系统在巴西属于犯罪行为（第 12.737/2012 号法律，即 Carolina Dieckmann 法），可能构成计算机设备入侵罪，可判处拘留。 摘要的摘要...
CVE-2026-102827
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...
CVE-2026-102827
The simple-git Node.js library is vulnerable to a command execution flaw in versions prior to 4.0.0 . The root cause is that the default blockUnsafeOperationsPlugin compares parsed option names against literal dangerous spellings but fails to account for unambiguous long-option abbreviations acce...
EUVD-2026-89333
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...
CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...
CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...
CVE-2026-102827: Improper Neutralization of Special Elements used in a Command
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...
PYSEC-2026-3873 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Reporter: Aaron / Aeon — autonomous security agent https://github.com/aaronjmars/aeon Project: omnigent-ai/omnigent v0.1.0 Databricks — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/shell.py shared parser → consumed by...
EUVD-2026-64014
Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/shell.py...
CVE-2026-62676
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...
CVE-2026-62676 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...
CVE-2026-62676 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...
CVE-2026-62676 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...
CVE-2026-58437
A flaw was found in Gitea. This vulnerability allows an attacker to manipulate repository visibility settings by leveraging specific Git push options. This could lead to unauthorized disclosure of repository information or unintended access control changes. Mitigation Mitigation for this issue is...
CVE-2026-58437 Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options...