{"action":"Upgrade githacker to 1.1.8 or later.","affected":[{"fixed":"1.1.8","introduced":"0"}],"component":"githacker","cve_ids":["CVE-2026-50024"],"ecosystem":"PyPI","epss":0.00451,"exploited":false,"fixed_versions":["1.1.8"],"ghsa_id":"GHSA-hr3m-4qwq-3mgc","id":"tcs_01M5KFM9TDMQ3WCFMEJNQCFFBN","modified_at":"2026-09-10T12:25:29.103803439Z","published_at":"2026-09-09T18:00:32Z","references":["https://osv.dev/vulnerability/GHSA-hr3m-4qwq-3mgc","https://github.com/WangYihang/GitHacker/security/advisories/GHSA-hr3m-4qwq-3mgc","https://github.com/WangYihang/GitHacker/commit/5f2a8ba","https://github.com/WangYihang/GitHacker"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-hr3m-4qwq-3mgc","url":"https://osv.dev/vulnerability/GHSA-hr3m-4qwq-3mgc"}],"summary":"GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server"}