CVE-2025-41390: TruffleHog Git RCE Vulnerability

CVE-2025-41390 Overview

CVE-2025-41390 is an arbitrary code execution vulnerability in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted Git repository can trigger arbitrary code execution when scanned by the tool. An attacker delivers a malicious repository to a victim running TruffleHog, and the act of scanning that repository executes attacker-controlled code on the local system.

The weakness is categorized as Inclusion of Functionality from Untrusted Control Sphere [CWE-829]. TruffleHog is widely used in CI/CD pipelines and developer workstations to scan source code for leaked secrets, which makes any user who scans third-party repositories a potential target.

Critical Impact
Scanning a malicious Git repository with TruffleHog 3.90.2 results in arbitrary code execution in the context of the user running the scanner, with high impact to confidentiality, integrity, and availability.

Affected Products

Truffle Security Co. TruffleHog 3.90.2
Earlier versions sharing the same git scanning code path may also be affected
Any CI/CD pipeline or developer workstation invoking the vulnerable TruffleHog version

Discovery Timeline

2025-10-20 - CVE-2025-41390 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41390

Vulnerability Analysis

The vulnerability lives in the git scanning functionality of TruffleHog, which spawns git operations against a target repository to enumerate commits and blobs for secret detection. When TruffleHog processes a repository whose contents or configuration the attacker controls, untrusted data influences a control sphere that results in execution of attacker-supplied code on the host.

The attack requires the victim to scan the malicious repository, which classifies the vector as local with user interaction. Successful exploitation grants the attacker the same privileges as the TruffleHog process. In automated pipelines this typically means a service account with access to source code, build artifacts, and credentials stored in the runner environment.

Refer to the Talos Vulnerability Report TALOS-2025-2243 for the full technical write-up.

Root Cause

The root cause is classified under [CWE-829] Inclusion of Functionality from Untrusted Control Sphere. TruffleHog incorporates behavior from the cloned repository into its own execution context without sufficiently isolating untrusted Git artifacts. A repository can ship configuration or hooks that the scanner inherits during normal git operations, turning a read-only analysis task into code execution.

Attack Vector

The attacker hosts or distributes a crafted Git repository, for example through a public code-sharing platform, a pull request, or a supply-chain dependency. A victim then runs TruffleHog 3.90.2 against that repository, either manually or via an automated pipeline. The crafted repository contents cause TruffleHog to execute attacker-controlled commands during the scan.

No authentication is required from the attacker, but the victim must initiate the scan. See the Truffle Security blog for additional context on the disclosure.

Detection Methods for CVE-2025-41390

Indicators of Compromise

Unexpected child processes spawned by the trufflehog binary, especially shells, interpreters, or network clients.
New or modified files in .git/hooks/ or unexpected core.fsmonitor, core.sshCommand, or core.editor entries inside scanned repositories.
Outbound network connections from CI/CD runners or developer hosts shortly after a TruffleHog scan begins.
Execution of trufflehog against repositories from untrusted or external sources.

Detection Strategies

Hunt for process trees where trufflehog is the parent of sh, bash, python, curl, wget, powershell, or other non-git binaries.
Inspect Git configuration files within scanned repositories for executable directives that reference external commands.
Correlate TruffleHog invocations with secret access events in CI/CD logs to identify suspicious credential reads following a scan.

Monitoring Recommendations

Forward endpoint and CI runner process telemetry to a central analytics platform and alert on anomalous child processes of scanning tools.
Enable command-line auditing on Linux build agents using auditd and on Windows runners using Sysmon Event ID 1.
Track TruffleHog version inventory across pipelines and developer workstations to surface unpatched 3.90.2 installations.

How to Mitigate CVE-2025-41390

Immediate Actions Required

Upgrade TruffleHog beyond version 3.90.2 to the latest release published by Truffle Security Co.
Audit CI/CD pipelines and developer workstations to inventory TruffleHog versions and remove or update vulnerable installs.
Restrict TruffleHog scans to repositories from trusted sources until patches are applied.
Rotate any secrets accessible to environments where TruffleHog 3.90.2 may have scanned untrusted repositories.

Patch Information

Review the Talos Vulnerability Report TALOS-2025-2243 and the Truffle Security project release notes for the fixed version and patch commits. Apply the vendor-supplied update across all hosts that invoke trufflehog, including container images used in build pipelines.

Workarounds

Run TruffleHog inside an ephemeral, network-restricted sandbox or container with no access to production credentials.
Execute scans under a low-privilege service account that lacks write access to source code, secrets, and build artifacts.
Disable execution of repository-supplied Git hooks and configuration by setting GIT_CONFIG_NOSYSTEM=1 and using git -c protocol.allow=user -c core.hooksPath=/dev/null style invocations where supported.
Avoid scanning untrusted third-party repositories on hosts that retain persistent credentials.

bash

# Configuration example: run TruffleHog in a constrained container
docker run --rm \
  --network=none \
  --read-only \
  --user 65534:65534 \
  -v "$(pwd)/repo:/scan:ro" \
  -e GIT_CONFIG_NOSYSTEM=1 \
  -e GIT_CONFIG_GLOBAL=/dev/null \
  trufflesecurity/trufflehog:latest \
  git file:///scan --no-update