GitAhead through version 2.7.1 contains a CWE-78 OS command injection flaw in its clean and smudge filter logic located in src/git/Filter.cpp. The bug allows specially crafted filenames supplied by a malicious repository to be passed directly to the system shell via bash -c, giving an attacker the ability to execute arbitrary commands on the machine where GitAhead is running. This can lead to complete compromise of the operating system, data loss, or further lateral movement. The vulnerability is a classic case of improperly handling user‑supplied input that ends up being interpreted as shell code.

The affected product is the GitAhead client, version 2.7.1. All installations of this release are vulnerable.

The CVSS score of 7.7 indicates a high severity and suggests that the vulnerability meets the criteria for remote code execution. The EPSS score of 1% indicates a very low but non‑zero probability of exploitation, and the issue has not been listed in the CISA KEV catalog, so no public exploitation data are currently known. Nevertheless, the attack would require an attacker to host or craft a repository with a .gitattributes file that references a filter and expose a filename containing a shell expansion such as $(id). When a victim runs git checkout, git add, or any other operation that triggers the filter, the victim’s shell will execute the injected command. Because the injected command runs with the same privileges as the GitAhead process, any user able to run GitAhead on a target machine could potentially steal data, install malware, or gain administrative rights.