{"action":"Upgrade githacker to 1.1.8 or later.","affected":[{"fixed":"1.1.8","introduced":"0"}],"component":"githacker","cve_ids":["CVE-2026-50024"],"ecosystem":"PyPI","epss":0.00451,"exploited":false,"fixed_versions":["1.1.8"],"ghsa_id":"GHSA-hr3m-4qwq-3mgc","id":"tcs_01M5KH826EGNR7HMN30BMKA3NX","modified_at":"2026-09-10T12:15:05.604348918Z","published_at":"2026-09-10T09:45:01.208337Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3835","https://github.com/WangYihang/GitHacker/security/advisories/GHSA-hr3m-4qwq-3mgc","https://github.com/WangYihang/GitHacker/commit/5f2a8ba","https://github.com/WangYihang/GitHacker","https://pypi.org/project/githacker","https://github.com/advisories/GHSA-hr3m-4qwq-3mgc","https://nvd.nist.gov/vuln/detail/CVE-2026-50024"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-3835","url":"https://osv.dev/vulnerability/PYSEC-2026-3835"}],"summary":"GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server"}