Medium, CVSS 5.3PyPIAmendedPublished
GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server
CVE-2026-50024 · GHSA-hr3m-4qwq-3mgc
- Affected
- PyPI githacker <= 1.1.7
- Fixed in
- 1.1.8· Vendor fix available
- Issue
- GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns any 40-character hex substring into an outbound HTTP GET — an existence oracle for arbitrary paths plus hex-fragment exfiltration of file contents. Details Vulnerability GitHacker rebuilds a remote .git/ by fetching files into tempdst. Two functions derived filesystem paths from server-controlled content: - addheadfiletasks reads the downloaded .git/HEAD, parses ref: <ref-path, and joins the raw ref-path onto tempdst/.git/logs/ before reading the resulting file. - addhashesparsed scans any file it reads for 40-character hex substrings and emits GET .git/objects/<sha[0:2]/<sha[2:] for each one — onto the attacker's server and into the local output tree. Pre-fix, addheadfiletasks did not…
Recommended action: Upgrade to 1.1.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.