{"items":[{"id":"NVI-00018476","kind":"vulnerability","title":"kas checks out SHA-like git branches as valid commits","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-qjwp-hrq6-r26r","CVE-2026-47191"],"plain_summary":"GitHub lists this reviewed advisory for kas. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2c3a5887c493ea5f2989eb678e6d2ca0"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2c3a5887c493ea5f2989eb678e6d2ca0","url":"https://github.com/advisories/GHSA-qjwp-hrq6-r26r","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-qjwp-hrq6-r26r","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:53:06.181Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2c3a5887c493ea5f2989eb678e6d2ca0"],"technology":"kas","known_exclusions":[],"conditions_summary":"### Impact\nWhen relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the referenced repository has been taken over by an attacker and modified to carry such a branch. SHA-1 commits may also be replaced by creating hash collisions, so the primary impact of this issue is on SHA-256 commit IDs.\n\n### Patches\nCommit https://github.com/siemens/kas/commit/4cb4a3d01122ffaec9feaae768a5814092f6f9b5 is resolving this issue. It has been released along with kas version 5.3.\n\n### Workarounds\nAvoid relying solely on the commit ID for integrity validation of a repository that might become under control of a malicious 3rd party. If available, additional validate cryptographically signed commits or tags. Alternatively, mirror the repository to a save place, validate its integrity, and use this instead of the original one.\n\n### Credits\nThat such issues exist was already reported 3 years ago by Aditya Sirish A Yelgundhalli. At this point, no strong integrity checks for externa","public_affected_ranges":["< 5.3"]}],"null_published_at":"2026-11-07T07:07:39.840Z","source_updated_at":"2026-06-04T18:33:57.000Z","source_disclosed_at":"2026-06-01T14:26:36.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:53:06.181Z"}],"next_cursor":null,"snapshot_revision":"42594"}