https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:49:07 +0000 https://cve.radiocsirt.org/vuln/cve-2026-50024 <p><strong>Affected:</strong> WangYihang GitHacker</p> <p>GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto temp_dst/.git/logs/, allowing a malicious server to make GitHacker read an arbitrary local file when a victim runs the tool against the server&#39;s URL. add_hashes_parsed then scans the file for 40-character hexadecimal substrings and requests each match through .git/objects using the first two characters and remaining characters as path components, creating an attacker-observable existence oracle and disclosing matching hexadecimal fragments. Complete file contents are not returned, and the add_folder and add_task write path in shipped version 1.1.7 does not permit an escape. This issue is fixed in repository version 1.1.9.</p> <p><strong>Affected:</strong> WangYihang GitHacker</p> <p>GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto temp_dst/.git/logs/, allowing a malicious server to make GitHacker read an arbitrary local file when a victim runs the tool against the server&#39;s URL. add_hashes_parsed then scans the file for 40-character hexadecimal substrings and requests each match through .git/objects using the first two characters and remaining characters as path components, creating an attacker-observable existence oracle and disclosing matching hexadecimal fragments. Complete file contents are not returned, and the add_folder and add_task write path in shipped version 1.1.7 does not permit an escape. This issue is fixed in repository version 1.1.9.</p> https://cve.radiocsirt.org/vuln/cve-2026-50024 https://cve.radiocsirt.org/vuln/ghsa-hr3m-4qwq-3mgc <p><strong>Affected:</strong> PyPI: githacker</p> <p>## Summary</p> <p>GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled `.git/HEAD` before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns any 40-character hex substring into an outbound HTTP `GET` — an existence oracle for arbitrary paths plus hex-fragment exfiltration of file contents.</p> <p>## Details</p> <p>### Vulnerability</p> <p>GitHacker rebuilds a remote `.git/` by fetching files into `temp_dst`. Two functions derived filesystem paths from server-controlled content:</p> <p>- `add_head_file_tasks` reads the downloaded `.git/HEAD`, parses `ref: &lt;ref-path&gt;`, and joins the raw ref-path onto `temp_dst/.git/logs/` before reading the resulting file. - `add_hashes_parsed` scans any file it reads for 40-character hex substrings and emits `GET .git/objects/&lt;sha[0:2]&gt;/&lt;sha[2:]&gt;` for each one — onto the attacker&#39;s server and into the local output tree.</p> <p>Pre-fix, `add_head_file_tasks` did not validate the ref segments. A malicious `.git/HEAD` of</p> <p>``` ref: ../../../../../../etc/passwd ```</p> <p>caused `add_head_file_tasks` to traverse out of `temp_dst` and read `/etc/passwd`. The bytes flowed into `add_hashes_parsed`, which emitted one outbound HTTP request per 40-char-hex match — observable on the attacker&#39;s logs.</p> <p>### Impact</p> <p>PR #65 originally classified this as arbitrary local file read. Joint analysis during coordinated disclosure narrowed th…</p> <p><strong>Affected:</strong> PyPI: githacker</p> <p>## Summary</p> <p>GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled `.git/HEAD` before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns any 40-character hex substring into an outbound HTTP `GET` — an existence oracle for arbitrary paths plus hex-fragment exfiltration of file contents.</p> <p>## Details</p> <p>### Vulnerability</p> <p>GitHacker rebuilds a remote `.git/` by fetching files into `temp_dst`. Two functions derived filesystem paths from server-controlled content:</p> <p>- `add_head_file_tasks` reads the downloaded `.git/HEAD`, parses `ref: &lt;ref-path&gt;`, and joins the raw ref-path onto `temp_dst/.git/logs/` before reading the resulting file. - `add_hashes_parsed` scans any file it reads for 40-character hex substrings and emits `GET .git/objects/&lt;sha[0:2]&gt;/&lt;sha[2:]&gt;` for each one — onto the attacker&#39;s server and into the local output tree.</p> <p>Pre-fix, `add_head_file_tasks` did not validate the ref segments. A malicious `.git/HEAD` of</p> <p>``` ref: ../../../../../../etc/passwd ```</p> <p>caused `add_head_file_tasks` to traverse out of `temp_dst` and read `/etc/passwd`. The bytes flowed into `add_hashes_parsed`, which emitted one outbound HTTP request per 40-char-hex match — observable on the attacker&#39;s logs.</p> <p>### Impact</p> <p>PR #65 originally classified this as arbitrary local file read. Joint analysis during coordinated disclosure narrowed th…</p> https://cve.radiocsirt.org/vuln/ghsa-hr3m-4qwq-3mgc