CVE-2026-105295
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic update checks, offer a fake version, and execute code as the user upon installation.
- CVSS 4.0
- 7.7 HIGHCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.13% probability · 2th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-494
- Source
- disclosure@vulncheck.com
EPSS moved from 0.1% on 5 October 2026 to 0.1% on 26 October 2026.
References
- https://github.com/gitahead/gitahead
- https://github.com/gitahead/gitahead/blob/v2.7.1/src/app/Application.cpp#L284-L309
- https://github.com/gitahead/gitahead/blob/v2.7.1/src/update/Updater.cpp#L176-L279
- https://github.com/gitahead/gitahead/issues/662
- https://www.vulncheck.com/advisories/gitahead-2.5.0-through-2.7.1-unverified-update-installation-and-tls-bypass
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.