Fatih Çelik@fatihclk01
General
Now tracked as CVE-2026-63728
Post summary
The text merely notes that a CVE (CVE-2026-63728) has been assigned, with no additional details or actionable information presented.
01053643
476 followersView on X
CVE-2026-63728Disclosure
LOWCVSS 8.1 · HIGHSignal is active with 2 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report templates using the env, expandenv, and getHostByName functions to extract credentials, tokens, and API keys from the host process and exfiltrate them through DNS queries, including secrets discovered during the scan itself.
0.0/ 10 priority
Sources & remediation
Other references
- https://fatihhcelik.github.io/posts/gitleaks-abusing-sprig-for-exfiltration/#the-fix
- https://github.com/gitleaks/gitleaks
- https://github.com/gitleaks/gitleaks/commit/83d9cd684c87d95d656c1458ef04895a7f1cbd8e
- https://www.vulncheck.com/advisories/gitleaks-secret-exfiltration-via-non-hermetic-sprig-template-functions-in-report-template-feature
- https://fatihhcelik.github.io/posts/gitleaks-abusing-sprig-for-exfiltration/#the-fix
Weakness type (CWE)
CWE-1336
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 2 mentions across 1 observed day
What's happening
- Technical details provided in 1 signal
- Disclosure: 1 classified signal
- General: 1 classified signal
- 2 total mentions across 1 day
Deep dive
Activity timeline2 mentions / 1d
Signal classification2 categories
Disclosure150.0%
General150.0%
Referenced assets1 URL
Full discourse2 posts
Vulmon Vulnerability Feed@VulmonFeedsDisclosureCVE-2026-63728 Template Injection Vulnerability in Gitleaks Prior to 8.30.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-63728
Post summary
This entry discloses a template injection vulnerability in Gitleaks versions before 8.30.1, with a reference link to a vulnerability database.
00000794.1K followersView on X