CVE-2025-41390

An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repository can lead to a arbitrary code execution. An attacker can provide a malicious respository to trigger this vulnerability...

CVE-2025-41390

CVE-2025-41390 concerns an arbitrary code execution in TruffleHog 3.90.2 through the Git core.fsmonitor handling. A specially crafted repository (e.g., copied file-for-file via tar/cp/rsync) can trigger execution when Git operations are invoked by tooling, due to a malicious core.fsmonitor value ...

CVE-2025-41390: Inclusion of Functionality from Untrusted Control Sphere

An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repository can lead to a arbitrary code execution. An attacker can provide a malicious respository to trigger this vulnerability...

Truffle Security Co. TruffleHog git arbitrary code execution vulnerability

Talos Vulnerability Report TALOS-2025-2243 Truffle Security Co. TruffleHog git arbitrary code execution vulnerability October 20, 2025 CVE Number CVE-2025-41390 SUMMARY An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially...

TruffleHog 安全漏洞

TruffleHog is an open source tool from Truffle Security. A security vulnerability exists in TruffleHog version 3.90.2, which stems from a specially crafted repository could lead to arbitrary code execution...

Self-Replicating Worm Hits 180+ npm Packages to Steal Credentials in Latest Supply Chain Attack

Cybersecurity researchers have flagged a fresh software supply chain attack targeting the npm registry that has affected more than 40 packages that belong to multiple maintainers. "The compromised versions include a function NpmModule.updatePackage that downloads a package tarball, modifies...

CVE-2025-54388 vulnerabilities

Vulnerabilities for packages: osv-scanner, telegraf, apko-fips, chainctl, openfga-fips, nerdctl-fips, zarf, opentelemetry-collector, trufflehog, buildkitd, wolfictl, trivy-fips, goreleaser, spire-server, k9s-fips, falcoctl-fips, beats-fips, cadvisor, grype-fips, opentelemetry-collector-contrib,...

GHSA-X4RX-4GW3-53P4 vulnerabilities

Vulnerabilities for packages: osv-scanner, telegraf, apko-fips, chainctl, openfga-fips, nerdctl-fips, zarf, opentelemetry-collector, trufflehog, buildkitd, wolfictl, trivy-fips, goreleaser, spire-server, k9s-fips, falcoctl-fips, beats-fips, cadvisor, grype-fips, opentelemetry-collector-contrib,...

CVE-2024-43379

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

TruffleHog Explorer - A User-Friendly Web-Based Tool To Visualize And Analyze Data Extracted Using TruffleHog

Welcome to TruffleHog Explorer , a user-friendly web-based tool to visualize and analyze data extracted using TruffleHog. TruffleHog is one of the most powerful secrets discovery, classification, validation, and analysis open source tool. In this context, a secret refers to a credential a machine...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, rclone, zarf, prometheus, velero, fulcio, octo-sts, azcopy, chezmoi, crossplane-provider-azure-managedidentity, bank-vaults, gomplate, gitness, step, rook, kubernetes, sigstore-scaffolding, thanos, kube-metrics-adapter, falcoctl, kots,...

GO-2024-3076 Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog

Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog...

Server-Side Request Forgery (SSRF)

TruffleHog is vulnerable to unauthorized request execution. The vulnerability is due to insufficient validation of the data being scanned by TruffleHog's detectors, which allows maliciously crafted data to trigger unauthorized requests to attacker-chosen endpoints...

SUSE CVE-2024-43379

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

Trufflehog vulnerable to Blind SSRF in some Detectors

Impact What kind of vulnerability is it? Who is impacted? This vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective,...

GHSA-3R74-V83P-F4F4 Trufflehog vulnerable to Blind SSRF in some Detectors

Impact What kind of vulnerability is it? Who is impacted? This vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective,...

CVE-2024-43379

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

CVE-2024-43379

CVE-2024-43379 concerns TruffleHog, a secrets-scanning tool. According to the connected documents, the issue is a Blind SSRF vulnerability in some detectors prior to version 3.81.9 . The attack requires an attacker-crafted input that, when scanned, could cause an unauthenticated GET endpoint that...

CVE-2024-43379 TruffleHog has a Blind SSRF in some Detectors

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

CVE-2024-43379 TruffleHog has a Blind SSRF in some Detectors

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...