AIKIDO-2026-818830
kas is vulnerable to Insufficient Verification of Data Authenticity
21
Low Risk
This Affects:
kasTL;DR
kas resolves git revisions requested by commit ID when cloning the repositories declared in its configuration. It only warns about commit IDs shorter than 40 characters, so abbreviated SHA-256 identifiers pass unchecked, and it does not confirm that the resolved commit matches the requested one. A referenced repository can therefore shadow the intended commit with a branch or tag of the same name, causing an unintended or malicious source revision to be checked out. The fix warns about all abbreviated commit hashes and fails when the read-back commit deviates from the specified value.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your kas configuration checks out repositories pinned by an abbreviated or externally influenced git commit ID.
Background info
kas is vulnerable to Insufficient Verification of Data Authenticity in versions 0.0.1 - 5.4.0.
How to fix this
Upgrade the kas library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant