PT-2025-42764 · Unknown · Trufflehog

Adam Reiser · Published 2025-10-20 · Updated 2025-10-20 · CVE-2025-41390

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TruffleHog version 3.90.2

Description An arbitrary code execution issue exists in the git functionality of TruffleHog. A specially crafted repository can trigger this, potentially leading to arbitrary code execution. An attacker can provide a malicious repository to exploit this.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2025-41390

Affected Products

Trufflehog

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-41390 · Security Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2025-2243 · Note
• https://twitter.com/BugBountyShorts/status/1980303306267255124 · Twitter Post
• https://twitter.com/CVEnew/status/1980286087139315863 · Twitter Post
• https://twitter.com/BugBountyShorts/status/1980296245143888308 · Twitter Post
• https://t.me/cveNotify/139410 · Telegram Post
• https://trufflesecurity.com/blog/contributor-spotlight-adam-reiser-of-cisco-talos · Note