ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

Exploit_CVE-2026-3854

ExploitCVE-2026-3854 CVE-2026-3854 es una ejecución remota de código en GitHub.com y GitHub Enterprise Server La vulnerabilidad podría explotarse inyectando comandos en el comando git push de la siguiente manera: root@kitploit: git push -o '' origin master Para revisar cualquier explotación de es...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

CVE-2026-60004

CVE-2026-60004 — RCE en diffpatch de Gitea PoC de ejecución remota de código en el endpoint diffpatch de Gitea. Una cuenta con permisos de escritura en un repositorio en instancias con registro abierto basta con registrarse de forma anónima puede ejecutar comandos shell arbitrarios en el servidor...

CVE-2025-24890

creationtimestamp| type| source ---|---|--- 2026-09-09 18:36:44+00:00| published-proof-of-concept| https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc...

GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...

GHSA-HR3M-4QWQ-3MGC GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...

agentic-ioc-scanner

agentic-ioc-scanner Escáner de IOC para herramientas de codificación de IA agéntica — detecta Mini Shai-Hulud, Gemini CLI RCE, Cursor CVE-2026-26268 y DPRK PromptMink. Un kit de detección para el compromiso de asistentes de codificación de IA agéntica Claude Code, Gemini CLI, Cursor y las...

CVE-2025-48384-submodule

CVE-2025-48384 Submodule This submodule contains a malicious post-checkout hook for demonstration...

CVE-2025-8110-PoC

CVE-2025-8110 PoC Script de prueba de concepto en Python para CVE-2025-8110 — RCE por symlink en UpdateRepoFile de Gogs v0.13.3. Disparo único: el propio PUT malicioso activa git fetch → sshCommand → reverse shell. ⚠️ Solo para fines educativos y de investigación de seguridad autorizada. Ejecutar...

CVE-2026-87817

A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...

CVE-2023-23946

CVE-2023-23946 Exploit This repository contains a functional Proof of Concept PoC exploit for CVE-2023-23946 , affecting Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. Demonstration Usage root@kitploit: git clone...

Regular Expression Denial of Service (ReDoS)

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the Actor.fromstring parsing in git/util.py. An attacker can exhaust CPU and stall commit metadata access by supplying a...

DEBIAN-CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

UBUNTU-CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

git-lfs security update

An update is available for git-lfs. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Git Large File Storage LFS replaces large files such as audio samples, video...

RLSA-2026:64788 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

CVE-2026-87817 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...