Vulnerability · Published Oct 7, 2026 · Assigned by VulnCheck

CVE-2026-106059GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript

High 8.8

In plain English

A high-severity OS command injection in gitahead from gitahead. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.3%top 29.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do shell script payload, which runs as the victim user when Show in Finder is chosen.

Affected products (as reported)

Vendor	Product	Versions
gitahead	gitahead	0 – through 2.7.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

GitHub Issue #663 issue-tracking
https://github.com/gitahead/gitahead product
https://github.com/gitahead/gitahead/blob/v2.7.1/src/tools/ShowTool.cpp#L40-L48 technical-description
VulnCheck Advisory: GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript third-party-advisory