MEDIUM 5.3 GitHub
CVE-2026-50024
GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server
## Summary
GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled `.git/HEAD` before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns any 40-character hex substring into an outbound HTTP `GET` — an existence oracle for arbitrary paths plus hex-fragment exfiltration of file contents.
## Details
### Vulnerability
GitHacker rebui
Affected Products
- pip/githacker <= 1.1.7
References
- https://github.com/advisories/GHSA-hr3m-4qwq-3mgc
- https://github.com/WangYihang/GitHacker/security/advisories/GHSA-hr3m-4qwq-3mgc
- https://github.com/WangYihang/GitHacker/commit/5f2a8ba
- https://github.com/advisories/GHSA-hr3m-4qwq-3mgc
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-09-09 via GitHub. Affected: pip/githacker <= 1.1.7.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.