Threats tagged 'brew-aider-cve-2026-110857'

GitPython contains three methods that omit critical unsafe protocol and option checks, leading to potential command injection risks. The ls_remote method forwards URLs without checking for unsafe protocols, allowing remote code execution if the victim's git transport policy permits the 'ext' protocol. The merge_base and IndexFile.move methods forward caller arguments without checking for unsafe options, exposing latent argument-injection surfaces. These issues remain unfixed as of the main branch commit dated 2026-09-21, after the latest release 3.1.62. The severity is anchored on the ls_remote issue, which can lead to remote code execution under certain configurations.