Executive brief
GitHacker is a Python tool that reconstructs `.git` directories from remote servers. Versions up to 1.1.7 did not properly validate paths parsed from a malicious `.git/HEAD` file, allowing an attacker to read arbitrary local files on the victim's system. While file contents cannot be directly exfiltrated wholesale, the tool's hex-pattern matching mechanism can be exploited to probe whether specific files exist and extract fragments containing 40-character hex strings (like password hashes or session tokens). The attack requires the victim to run GitHacker against an attacker-controlled URL.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in two functions: `add_head_file_tasks` and `add_hashes_parsed`. The former parses the `ref: <path>` directive from `.git/HEAD` without validating path segments, allowing sequences like `ref: ../../../../../../etc/passwd` to escape the intended `temp_dst` directory and read arbitrary files. The latter scans all read files for 40-character hex substrings and emits HTTP GET requests to fetch corresponding objects—turning these matches into an existence oracle and exfiltration channel visible in attacker logs. The fix (commit 5f2a8ba) introduces `_is_safe_path_segment`, an allowlist-based validator applied at queue-time to reject empty strings, `.`, `..`, separators, NUL bytes, and control characters. Patched in version 1.1.8.
Affected products
- WangYihang GitHacker <= 1.1.7
Timeline
- 2026-09-09: disclosed: Published to GitHub Advisory Database
- 2026-09-09: patched: Fixed in version 1.1.8 (commit 5f2a8ba)
- 2026-09-09: advisory