【Security】： security issue report

[360AlphaLab]

Hi maintainers,

I have identified a potential security issue in tig and would like to report it responsibly.

I could not find a SECURITY.md file or a documented vulnerability disclosure process for this repository. I also do not want to disclose technical details, reproduction steps, or proof-of-concept information publicly in a GitHub issue.

Could you please let me know the preferred private channel for reporting security issues, or enable GitHub private vulnerability reporting for this repository?

I can provide the following privately:

• affected files and versions/commit ranges
• impact assessment and severity
• reproduction steps
• proof-of-concept evidence
• recommended remediation options

Thanks.

[360AlphaLab]

Hi maintainers,

I’m following up with a brief, non-sensitive summary to help with triage.

The issue I found is a potential command injection / local command execution vulnerability in tig’s editor-opening workflow. In short, when tig opens a file from a repository in an editor, a specially crafted repository path or filename may be interpreted in a shell execution context and cause unintended command execution under the current user’s privileges.

The affected functionality appears to be the normal “open in editor” path used from multiple tig views, including status, diff, blame/blob, tree, grep, and stage-related views. The impact is local code execution after user interaction with a crafted repository entry. A victim would not need to manually type or knowingly run a malicious command; ordinary tig navigation followed by opening a file in the editor may be sufficient.

Based on my testing, this appears to affect tig 2.6.0 and the current master branch. Older versions before the editor-opening behavior changed may not be affected, but I would prefer to share the exact commit range and technical analysis privately.

I’m intentionally not posting reproduction steps, payloads, affected source lines, or proof-of-concept details publicly here.

I can provide the full report privately, including:

• affected versions / commit range
• affected code path
• impact assessment
• reproduction steps
• proof-of-concept evidence
• suggested remediation approach

Could you please let me know whether you prefer a private disclosure channel, GitHub private vulnerability reporting, or whether you want me to continue with a sanitized technical report in this issue?