Cyber ·
CVE-2026-112818: cross-repository data exfiltration in git-annex
Advisory dated 26 October 2026 from the git-annex maintainer: version 10.20261026 fixes a flaw that allowed data exfiltration between repositories, with backported patches for earlier versions.
According to the advisory relayed through the oss-sec feed, Joey Hess announced on 26 October 2026 the release of git-annex 10.20261026, which fixes a cross-repository data exfiltration attack. The identifier for this case is CVE-2026-112818.
For maintainers of earlier versions, the author states that backported patches are available as branches in the Git repository, identified by the CVE code and the base version (10.20250416, 10.20251029 and 10.20261006). The source does not detail the technical mechanism of the flaw or the exact scope of the affected data.
Relevance: Rota Nacional does not patch, audit or operate git-annex and does not claim to solve this problem. This is a security advisory about a third-party software tool, not a platform feature.
How to consult and verify: read the original advisory on the oss-sec list, dated 26 October 2026, and the project's official download page. Confirm the installed version with git-annex's own version command before and after updating.
Original source: CVE-2026-112818: exfiltração de dados entre repositórios no git-annex