Git-Annex - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/git-annex/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 21:53:40 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svggit-annex: Cross-repository data exfiltration (CVE-2026-112818)https://feed.craftedsignal.io/briefs/2026-10-git-annex-data-exfiltration/Tue, 27 Oct 2026 21:53:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-git-annex-data-exfiltration/A security vulnerability in git-annex (CVE-2026-112818) allows for unauthorized cross-repository data exfiltration, requiring an update to version 10.20261026 or the application of backported patches.git-annex versions prior to 10.20261026 are vulnerable to a cross-repository data exfiltration flaw, tracked as CVE-2026-112818. This vulnerability allows for unauthorized access or leakage of data between managed repositories. The maintainer has released a patched version and provided backported patches for previous releases to address the risk.

Impact

Successful exploitation allows for the unauthorized exfiltration of data across repositories managed by git-annex, potentially leading to the exposure of sensitive information stored in those environments.

Recommendation

  • Upgrade git-annex to version 10.20261026 or apply the available backported patches provided by the maintainer for older versions.
  • Inventory systems utilizing git-annex to identify versions requiring the security update.
]]>highadvisoryexfiltrationvulnerabilitygit-annex