On macOS, ShowTool::start() interpolates a repository-controlled file path verbatim into an AppleScript string passed to osascript . A file whose name contains a double-quote plus AppleScript string-concatenation escapes the quoted string and injects AppleScript — including do shell script , which executes arbitrary shell commands with the privileges of the user running GitAhead. Triggered by right-clicking the file and choosing "Show in Finder".
v2.7.1 (verified at commit 1cfc416 ), affected since at least v2.5.0 (identical sink verified in that tag; originates from the 2018 source import). No fixed version.
src/tools/ShowTool.cpp:43-48 :
mFile is assigned unmodified in ExternalTool.cpp:44 from a path built in src/ui/FileContextMenu.cpp:59-62 (repo.workdir().filePath(file) → new ShowTool(path)); the filename portion is committed tree bytes, attacker-controlled. No escaping exists anywhere on this path (verified by ). Invocation is list-form startDetached (no shell), so the injection surface is the AppleScript parser, reached via the context- click handler at FileContextMenu.cpp:337-340 (tool->start()).
Byte-exact generated string proven with the real Qt QString construction, e.g. filename x" & do shell script "touch /tmp/MARK" & ".evil produces: reveal POSIX file "/repo/x" & do shell script "touch /tmp/MARK" & ".evil"
Filename proven committable/versionable through git plumbing (round-trips byte-identically; only Windows-build protectNTFS rejects it — inapplicable on macOS/APFS where " is legal).
Lone-quote names fail closed (AppleScript syntax error); the balanced form above is the working shape.
[MAC RESULT: osascript execution run on on macOS — marker created / not created; exit code; Finder behavior.]
Remote code execution as the victim user on macOS (user context, not root/sandbox escape), requiring the victim to open a malicious repository and invoke "Show in Finder" on a crafted filename.
CWE-78 / CWE-116 (AppleScript code injection leading to shell exec)
Suggested CVSS 3.1: 8.8 High — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (provisional pending execution confirmation; macOS-only scope noted)
Escape \ and " when building the AppleScript literal, or preferably stop interpolating paths into script source (e.g. reveal via NSWorkspace APIs, or pass the path out-of-band instead of embedding it in osascript -e source).
Activity on this issue will appear here.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
