CVE-2026-105295
highGitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently…
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic update checks, offer a fake version, and execute code as the user upon installation.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/gitahead/gitahead disclosure@vulncheck.com
- https://github.com/gitahead/gitahead/blob/v2.7.1/src/app/Application.cpp#L284-L309 disclosure@vulncheck.com
- https://github.com/gitahead/gitahead/blob/v2.7.1/src/update/Updater.cpp#L176-L279 disclosure@vulncheck.com
- https://github.com/gitahead/gitahead/issues/662 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/gitahead-2.5.0-through-2.7.1-unverified-update-instal... disclosure@vulncheck.com