CVE-2025-41390: Truffle Security Co Trufflehog

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repository can lead to a arbitrary code execution. An attacker can provide a malicious respository to trigger this vulnerability.

Affected products

• Truffle Security Co Trufflehog: version 3.90.2 only

Published 2025-10-20. Last modified 2026-10-08.