CVE-2016-7794 in git-hub
Summary
by MITRE
sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository name.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/14/2026
The CVE-2016-7794 vulnerability represents a critical remote code execution flaw in the sociomantic-tsunami git-hub library version 0.10.2 and earlier. This vulnerability specifically targets the handling of repository names during git operations, creating an attack surface where malicious actors can manipulate the input to execute arbitrary code on the target system. The flaw exists in the way the library processes repository identifiers, particularly when these names contain specially crafted payloads that bypass normal validation mechanisms.
The technical implementation of this vulnerability stems from improper input sanitization and validation within the git-hub library's repository name handling code. When a user provides a repository name, the library fails to properly escape or validate special characters that could be interpreted as shell commands or code execution directives. This creates a classic command injection vulnerability where attacker-controlled input flows directly into system execution contexts without adequate sanitization. The vulnerability is particularly dangerous because it occurs at the repository naming level, which is a fundamental operation in git workflows, making it accessible through common git operations like cloning or fetching repositories.
From an operational impact perspective, this vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of the sociomantic-tsunami git-hub library. Attackers can leverage this to gain full system control, potentially leading to data breaches, system compromise, or further lateral movement within networks. The attack vector is particularly concerning because it can be triggered through normal git operations, making it difficult to detect and prevent through conventional network monitoring. The vulnerability affects any system that uses the affected library for git operations, including development environments, CI/CD pipelines, and automated deployment systems that rely on git-hub for repository management.
The vulnerability aligns with CWE-77 and CWE-94 categories, representing command injection and code injection flaws respectively, which are classified under the MITRE ATT&CK framework as part of the Execution tactic. Organizations using vulnerable versions of this library face significant risk exposure, particularly in environments where automated git operations are performed without proper input validation. The remediation strategy involves upgrading to version 0.10.3 or later, which includes proper input validation and sanitization mechanisms. Additionally, organizations should implement network segmentation, monitor git operations for suspicious repository names, and conduct regular security assessments of their dependency management processes to prevent similar vulnerabilities from emerging in other components of their software supply chain.
The broader implications of this vulnerability highlight the importance of secure coding practices in library development and the critical need for proper input validation in all system components. This flaw demonstrates how seemingly benign operations like repository naming can become attack vectors when proper security controls are not implemented. Security practitioners should consider this vulnerability as part of their comprehensive vulnerability management strategy, ensuring that all dependencies are regularly updated and that proper security controls are in place to prevent similar issues from affecting other components in their software ecosystems. The incident underscores the necessity of maintaining up-to-date security patches and implementing robust dependency management practices to protect against supply chain attacks that exploit vulnerabilities in third-party libraries.