CVE-2026-105295

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105295
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105295.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105295
Published
2026-10-05T00:44:19Z
Modified
2026-10-06T02:47:21Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass
Details

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic update checks, offer a fake version, and execute code as the user upon installation.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-494"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105295.json"
}
References

Affected packages

Git / github.com/gitahead/gitahead

Affected ranges

Type
GIT
Repo
https://github.com/gitahead/gitahead
Events
Introduced
657c9ad4c5e105544481068767990d56e15ae4e5
Fixed
af959bff3b6de4102eccb6bd401519a9dc01b969
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.5.0"
        },
        {
            "last_affected":  "2.7.1"
        },
        {
            "fixed":  "2.7.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v2.*
v2.5.0
v2.5.1
v2.5.10
v2.5.2
v2.5.3
v2.5.4
v2.5.5
v2.5.6
v2.5.7
v2.5.8
v2.5.9
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105295.json"