git-annex checksum exposure to encrypted special remotes
Affects git-annexSource GCVE Database
Rated Low by Threat Radar's AI analysis
- Patch
- Available – fixed in 10.20260717
Data as of 30 Oct 2026, 11:00 UTC
What to do
Upgrade git-annex to 10.20260717.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Homebrewgit-annexpkg:brew/git-annexOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade git-annex to version 10.20260717 or later, where the vulnerability has been fixed. No other mitigation actions are required as the issue is resolved by this official patch.
Description
A vulnerability in git-annex allowed the checksum of annexed files to be exposed to encrypted special remotes during resumed uploads. Encrypted special remotes are not supposed to access the checksum of the unencrypted file, making this a privacy concern. The issue is considered low severity and was fixed in git-annex version 10.20260717.