CVE-2026-75913 CodeWhale before 0.8.64 Argument Injection via git_show

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75913 CodeWhale before 0.8.64 Argument Injection via git_show

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75913

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75913 CodeWhale before 0.8.64 Argument Injection via git_show

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75912

CodeWhale's git_blame tool passes an unvalidated rev parameter directly to git, allowing attackers to inject options like --contents=/path/to/file to exfiltrate sensitive files (SSH keys, credentials) via tool output. CVSS 3.1 score 7.4 (High). Fixed in CodeWhale 0.8.64. No in-the-wild exploitati...

CVE-2026-75912

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

CVE-2026-75912 CodeWhale before 0.8.64 Argument Injection via git_blame

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

CVE-2026-75912 CodeWhale before 0.8.64 Argument Injection via git_blame

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

SUSE CVE-2026-53790

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...

The vulnerability of the Diffable.diff method in the Python library for interacting with git repositories in GitPython allows a hacker to re-write any files in the system.

The vulnerability of the Diffable.diff method in the Python library for interacting with git repositories in GitPython relates to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to re-write any files in the system remotely...

PT-2026-77164

Name of the Vulnerable Software and Affected Versions CodeWhale versions 0.8.41 through 0.8.63 Description An argument injection issue exists in the git show tool. The rev parameter is passed unvalidated into the git show argument vector without an --end-of-options sentinel, allowing a value...

PT-2026-77163

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description An argument injection flaw exists in the git blame tool. This occurs because the rev parameter is not properly validated, allowing attackers to inject git options. By providing specific values to...

CVE-2026-73682

CVE-2026-73682 affects Semaphore prior to version 2.18.20. The vulnerability is an OS command injection via the repository handling of git_url, allowing an authenticated project Manager or Owner to trigger remote code execution on the Semaphore server host by crafting a malicious git_url with git...

CVE-2026-73621

A flaw was found in GitPython. An argument injection vulnerability in the Commit.count method allows an attacker to control options passed to the method. By supplying a crafted output option, an attacker can cause the git rev-list command to truncate an arbitrary file to zero bytes. This enables...

GO-2024-3296 vulnerabilities

Vulnerabilities for packages: gh...

Linux Distros Unpatched Vulnerability : CVE-2026-73621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count method, which forwards keyword arguments to 'git rev-list' without the...

AZL-95834 CVE-2026-53790 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...

ALPINE-CVE-2026-53790

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...

EUVD-2026-58098

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...

CVE-2026-53790

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...