CVE-2026-63728

Katalog CVE

CVSS 6.3 · Medium EPSS 0,21%

Kerentanan Improper Neutralization of Special Elements Used in a Template Engine. Skor CVSS 3.1 6.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report templates using the env, expandenv, and getHostByName functions to extract credentials, tokens, and API keys from the host process and exfiltrate them through DNS queries, including secrets discovered during the scan itself.

Rincian

Terbit di NVD

21 Juli 2026

Terakhir diubah

22 Juli 2026

Status NVD

Awaiting Analysis

CVSS 3.1

6.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 9,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://fatihhcelik.github.io/posts/gitleaks-abusing-sprig-for-exfiltration/#the-fix
• https://github.com/gitleaks/gitleaks
• https://github.com/gitleaks/gitleaks/commit/83d9cd684c87d95d656c1458ef04895a7f1cbd8e
• https://www.vulncheck.com/advisories/gitleaks-secret-exfiltration-via-non-hermetic-sprig-template-functions-in...