CVE-2026-105295

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic update checks, offer a fake version, and execute code as the user upon installation.

CVSS 4.0

7.7CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-25)

CWE

CWE-494

Published

2026-10-05

Modified

2026-10-06

Record from

the NVD, synced 2026-10-19

References

• https://github.com/gitahead/gitahead
• https://github.com/gitahead/gitahead/blob/v2.7.1/src/app/Application.cpp#L284-L309
• https://github.com/gitahead/gitahead/blob/v2.7.1/src/update/Updater.cpp#L176-L279
• https://github.com/gitahead/gitahead/issues/662
• https://www.vulncheck.com/advisories/gitahead-2.5.0-through-2.7.1-unverified-update-installation-and-tls-bypass

Check your stackJSON