Answer in brief
CVE-2026-128034 records a Medium severity (CVSS 5.5) vulnerability in gittuf: File protection rules bypassed for filenames with special characters. The current sources do not mark it as known exploited. The current feed maps gittuf/github.com/gittuf/gittuf (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps gittuf/github.com/gittuf/gittuf (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| gittuf/github.com/gittuf/gittufgeneric | >=0 <0.18.0 | 0.18.0 |
Published upstream
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 13, 2026
In gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by default for files with special characters (for example non-ASCII characters) instead of the raw paths. Such paths do not match patterns like file:internal/*, so the files are treated as unprotected, and a user who is not authorized by a file protection rule can change a protected file whose name contains special characters and still pass verification.
Quoted source text, attributed separately from HOL analysis.