CVE-2026-60004

CVE-2026-60004 Gitea diffpatch RCE ★ CVE-2026-60004 Gitea diffpatch GitフックRCE PoC ★ https://github.com/user-attachments/assets/403a70f4-4ff4-4ab7-b11c-d73d70adaf0b 概要 CVE-2026-60004 は、Gitea における リモートコード実行（RCE） の脆弱性です。 diffpatch APIは、提供されたパッチを git apply --cached...

CVE-2026-60004-gitea-0day

CVE-2026-60004 - Gitea = 1.27.0 事前認証RCE これは、Gitea バージョン 1.17 から 1.27.0 における重大なリモートコード実行脆弱性である CVE-2026-60004 の概念実証エクスプロイトです。このスクリプトは、ユーザー登録からターゲットサーバー上での安定した対話型シェルの確立まで、エクスプロイトチェーン全体を自動化します。 背景 脆弱性は /diffpatch APIエンドポイントに存在します。悪意のあるパッチを2回送信すると、add/add の衝突により、--cached...

CVE-2026-60004

CVE-2026-60004 — Gitea diffpatch RCE Gitea diffpatch エンドポイントのリモートコード実行 PoC。リポジトリへの書き込み権限を持つアカウントオープン登録インスタンスでは登録するだけがあれば、サーバー上で Gitea サービスアカウント として任意のシェルコマンドを実行できます。 脆弱性の概要 POST /api/v1/repos/owner/repo/diffpatch は、共有の ベア一時クローンリポジトリ に攻撃者が制御するパッチを適用します: root@kitploit: git apply --index --recount...

Astra Linux – Vulnerability in git-lfs

Git LFS is an extension to Git for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository’s working tree with the contents of Git LFS objects, certain Git LFS commands might write to files that are visible outside the current Git working tree, if symboli...

Security update for git-lfs (important)

openSUSE Security Update: Security update for git-lfs Announcement ID: openSUSE-SU-2026:0305-1 Rating: important References: 1239322 1252259 Cross-References: CVE-2025-22869 CVE-2025-26625 CVSS scores: CVE-2025-22869 SUSE: 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

Exploit for CVE-2026-60004

CVE-2026-60004 Gitea diffpatch RCE ★ CVE-2026-60004 Gitea di...

Exploit for Incorrect Behavior Order in Github Copilot-Cli

Claude Code — git bare-repo / core.fsmonitor guard bypass P...

CVE-2026-45033

GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent...

CVE-2026-45033

GitHub Copilot CLI (affected component: Git operations in Copilot CLI) contains a local privilege/command execution flaw exposed when a malicious bare git repository is nested within a project directory. The issue arises from git auto-discovery of bare repositories during directory traversal, all...

CVE-2026-45033

GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent...

CVE-2026-45033 GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent...

GHSA-9CCR-R5HG-74GF GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

Summary A security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory...

GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

Summary A security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory...

Incorrect Behavior Order

Overview @github/copilot is a GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal. Affected versions of this package are vulnerable to Incorrect Behavior Order that enables code execution via the core.fsmonitor configuration key in a nested bare git repository. A...

PT-2026-39901

Name of the Vulnerable Software and Affected Versions GitHub Copilot CLI versions prior to 1.0.43 Description An issue exists where a malicious bare git repository nested inside a project directory can lead to arbitrary code execution when the agent performs git operations. By exploiting git's...

git-lfs: Git LFS may write to arbitrary files via crafted symlinks

A flaw was found in Git LFS. Running git lfs checkout and git lfs pull in a specially crafted repository, specifically with symbolic or hard links tracked by Git LFS and pointing to files outside the working tree or in a bare repository, can cause Git LFS to write to arbitrary file system locatio...

git-lfs: Git LFS may write to arbitrary files via crafted symlinks

A flaw was found in Git LFS. Running git lfs checkout and git lfs pull in a specially crafted repository, specifically with symbolic or hard links tracked by Git LFS and pointing to files outside the working tree or in a bare repository, can cause Git LFS to write to arbitrary file system locatio...

git-lfs: Git LFS may write to arbitrary files via crafted symlinks

A flaw was found in Git LFS. Running git lfs checkout and git lfs pull in a specially crafted repository, specifically with symbolic or hard links tracked by Git LFS and pointing to files outside the working tree or in a bare repository, can cause Git LFS to write to arbitrary file system locatio...

git-lfs: Git LFS may write to arbitrary files via crafted symlinks

A flaw was found in Git LFS. Running git lfs checkout and git lfs pull in a specially crafted repository, specifically with symbolic or hard links tracked by Git LFS and pointing to files outside the working tree or in a bare repository, can cause Git LFS to write to arbitrary file system locatio...

git-lfs: Git LFS may write to arbitrary files via crafted symlinks

A flaw was found in Git LFS. Running git lfs checkout and git lfs pull in a specially crafted repository, specifically with symbolic or hard links tracked by Git LFS and pointing to files outside the working tree or in a bare repository, can cause Git LFS to write to arbitrary file system locatio...