The official CVE record is not published yet
Listed from a security news or mailing-list post. Details may change. It will be replaced with the CVE.org / NVD record once published.
git-annex cross-repository data exfiltration
Summary
Posted by Joey Hess on Oct 26I have released git-annex 10.20261026, which fixes a cross-repository data exfiltration attack. https://git-annex.branchable.com/download/ There are also backported patches for several past versions available as branches in the git repository: CVE-2026-112818-patch-10.20...
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-112818 git-annex
Original description The description as published by the source.
Posted by Joey Hess on Oct 26I have released git-annex 10.20261026, which fixes a cross-repository data exfiltration attack. https://git-annex.branchable.com/download/ There are also backported patches for several past versions available as branches in the git repository: CVE-2026-112818-patch-10.20250416 CVE-2026-112818-patch-10.20251029 CVE-2026-112818-patch-10.20261006...
(oss-security (Openwall): CVE-2026-112818: git-annex cross-repository data exfiltration)
Source: oss-security (Openwall) NVD