Threats affecting pkg:brew/mentat

GitPython's Submodule.move() API does not properly handle symbolic links in intermediate path components, allowing an attacker-controlled symlink to redirect a submodule move operation outside the parent repository worktree. This can cause the submodule checkout to be moved to an attacker-selected directory outside the repository, corrupting the repository's index and configuration state. The issue requires an attacker-controlled repository with a symlink and an application that calls Submodule.move() with a path under that symlink. No code execution or confidentiality impact is demonstrated.

GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method where an attacker-controlled branch name can be interpreted as a git command option, leading to arbitrary file read. This occurs because the positional branch name argument is passed to git checkout without proper sanitization or a '--' separator, allowing a malicious branch name like '--pathspec-from-file=/etc/passwd' to cause the contents of sensitive files to be returned in exceptions. The vulnerability affects all published releases up to 3.1.62 and the main branch at commit 4905b4af. The issue is a partial regression of previous fixes that only protected keyword arguments but not positional arguments in this method.

GitPython's Remote.pull() method improperly handles its positional refspec argument, allowing an attacker controlling this input to inject a --upload-pack option that bypasses unsafe option checks. This leads to arbitrary command execution with the privileges of the calling process when pulling from local-path or SSH transports. The vulnerability arises because the unsafe-option guard only inspects keyword arguments, not the positional refspec, which is forwarded verbatim to the git pull command. Exploitation requires attacker influence over the refspec parameter and a vulnerable transport type.

GitPython versions >=1.0.8 contain vulnerabilities in three wrapper methods that omit critical unsafe protocol and option checks. The ls_remote method forwards URLs unchecked, allowing remote code execution (RCE) if the victim's git transport policy permits the 'ext' protocol. The merge_base and IndexFile.move methods forward caller arguments without proper guards, creating latent injection surfaces. These issues were verified on the main branch after the latest release, indicating they remain unfixed. The vulnerability is related to prior CVEs addressing unsafe protocol and option checks but represents residual gaps in the rollout of these protections.

Mentat's GitPython integration has a vulnerability in the parse_actor_and_date() function due to a regex pattern that causes quadratic backtracking on malformed author, committer, or tagger identity lines missing or having malformed epoch or timezone data. This leads to significant CPU exhaustion when processing crafted commit or tag objects. The issue persists in version 3.1.62 despite a prior fix in 3.1.60 for a related regex. The vulnerability can cause delays of several seconds per access to affected fields in untrusted repositories.

GitPython's Repo._clone() method improperly expands environment variables in the separate_git_dir parameter derived from attacker-controlled .gitmodules submodule names. This leads to leakage of environment variable values as directory names on disk and in debug logs when DEBUG-level logging is enabled. The vulnerability arises because Git.polish_url() is called without disabling variable expansion on untrusted input, unlike other similar calls. An attacker can craft a malicious repository with a submodule name containing environment variable syntax to exploit this behavior.

A vulnerability in h11 versions before 0.15.0 allows malformed HTTP/1.1 chunked-encoding bodies to be accepted due to lenient parsing of trailing line terminators. This can cause request smuggling when combined with a buggy reverse proxy that parses chunked bodies differently. The issue is fixed in h11 0.15.0. Exploitation requires both h11 and a proxy to have incompatible parsing bugs.