Threats tagged 'brew-cruft-cve-2026-110859'

GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method where an attacker-controlled branch name can be used to perform an arbitrary file read. This occurs because the branch name is passed as a positional argument to git checkout without proper sanitization or a separator, allowing injection of git options such as --pathspec-from-file. An attacker hosting a repository with a malicious default branch name can cause a consumer application that clones and checks out this branch to read arbitrary files accessible to the process, such as /etc/passwd. The issue is a partial regression of prior fixes and affects all published releases up to 3.1.62. The vulnerability has a CVSS 3.1 score of 7.5 (High).