GitAhead: Command injection via Show in Finder on macOS
Summary
GitAhead through version 2.7.1 on macOS builds an AppleScript command for the Show in Finder function by inserting the repository file path without escaping. A crafted file name in a repository can therefore inject shell commands. The commands run with the rights of the logged-in user when the victim opens such a repository and selects Show in Finder.
Affected
- GitAhead up to and including 2.7.1 on macOS (CNA range: <= 2.7.1)
- Windows and Linux are not named in the CVE description
- Unknown whether later versions exist and are patched
Fixed in
Unknown. A fix commit is referenced by OSV, but no released version containing the fix has been identified.
Workaround
- Do not use Show in Finder on files from untrusted repositories
- Do not open untrusted repositories in GitAhead on macOS until a fixed build is confirmed
- Use a different Git client for untrusted repositories
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total
- Not known to be exploited in the wild; KEV: No
- Publicly described in GitHub issue #663; no verified public exploit found
- Reproduction on macOS not confirmed in the sources reviewed
Our recommendation
- Check whether GitAhead is installed on any Mac in the fleet
- Restrict use to trusted repositories and avoid Show in Finder on untrusted files
- Replace GitAhead for untrusted repositories until the vendor confirms a fix
- Monitor the vendor repository and the NVD entry for updates
- Priority: medium overall; higher where developers routinely open third-party repositories on Macs
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-106059 advisory (VulnCheck) www.vulncheck.com
- GitHub issue #663 github.com
- ShowTool.cpp at v2.7.1 github.com
- GitAhead repository github.com
- OSV entry CVE-2026-106059 osv.dev
- GitAhead releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:25.
Original description (NVD)
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do shell script payload, which runs as the victim user when Show in Finder is chosen.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.