CVE-2026-128034 · Package
NO FIX YET · SEE WHAT TO DO
gittuf, a Git security tool, checks file protection rules against the quoted pathnames Git prints for names with non-ASCII or special characters instead of the real paths. An unauthorized user can change a protected file whose name contains such characters and still pass verification.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that use gittuf to enforce file protection rules on repositories containing files with non-ASCII or special-character names. Repositories without gittuf, or without file protection rules, are not exposed through this flaw.
Not affected if ascii-filenames-only, no-file-protection-rules, no-gittuf
Who cares git, gittuf, supply-chain
gittuf version; versions before 0.18.0 are affected.0.18.0 or laterIn gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by default for files with special characters (for example non-ASCII characters) instead of the raw paths. Such paths do not match patterns like file:internal/*, so the files are treated as unprotected, and a user who is not authorized by a file protection rule can change a protected file whose name contains special characters and still pass verification.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.