Path traversal in WangYihang GitHacker
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto temp_dst/.git/logs/, allowing a malicious server to make GitHacker read an arbitrary local file when a victim runs the tool against the server's URL. add_hashes_parsed then scans the file for 40-character hexadecimal substrings and requests each match through .git/objects using the first two characters and remaining characters as path components, creating an attacker-observable existence oracle and disclosing matching hexadecimal fragments. Complete file contents are not returned, and the add_folder and add_task write path in shipped version 1.1.7 does not permit an escape. This issue is fixed in repository version 1.1.9.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WangYihang | GitHacker | before 1.1.8 | 1.1.8 | Patch available | CNA |
| — | githacker (PyPI) | before 1.1.8 | 1.1.8 | Patch available | GHSA-hr3m-4qwq-3mgc |
- GitHacker VendorWangYihang Affected before 1.1.8 Fixed in 1.1.8 Patch available CNA
- githacker (PyPI) Vendor— Affected before 1.1.8 Fixed in 1.1.8 Patch available GHSA-hr3m-4qwq-3mgc
Remediation
- Fix · CNA GitHacker (WangYihang) Fixed in 1.1.8
- Fix · GHSA-hr3m-4qwq-3mgc githacker (PyPI) Fixed in 1.1.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-50024
- 2026-10-03 Alias added: GHSA-hr3m-4qwq-3mgc
References
Other 6
- https://github.com/WangYihang/GitHacker/security/advisories/GHSA-hr3m-4qwq-3mgc
- https://github.com/WangYihang/GitHacker/pull/65
- https://github.com/WangYihang/GitHacker/commit/16fcd81a9c3dfdf39713fde360d4e8bc3acf99e7
- https://github.com/WangYihang/GitHacker/commit/5f2a8ba4d451c6a1a465893507fbc42535a9d8c8
- https://github.com/WangYihang/GitHacker/commit/5f2a8ba
- https://github.com/WangYihang/GitHacker
Sources
- CVE-2026-50024 · CVE Program
- CVE-2026-50024 · NVD
- FIRST EPSS
- GHSA-hr3m-4qwq-3mgc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences