Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-124039

Gitleaks through 8.30.1 World-Readable Report Files via --report-path

Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gitleaks
Products
Gitleaks
CVE-2026-63728

Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report templates using the env, expandenv, and getHostByName functions to extract credentials, tokens, and API keys from the host process and exfiltrate them through DNS queries, including secrets discovered during the scan itself.

CVSS 4.0 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Gitleaks
Products
Gitleaks