Threats tagged 'brew-cruft-cve-2026-114145'

A vulnerability in the Cruft library's GitPython integration allows an attacker to execute arbitrary code by planting a malicious Git hook. The create_submodule function clones a submodule into the repository's .git directory before validating the path. Specifically, a path like ".git/hooks" is accepted initially, causing the submodule to be cloned directly into the live hooks directory. This results in an attacker-controlled executable hook file (e.g., post-checkout) being placed and executed on subsequent Git operations. Versions 3.1.x silently allow this, while 3.2.0 and later raise a ValueError after cloning, but do not remove the planted hook, so the risk remains. The vulnerability affects versions from 3.1.59 through 3.2.0 plus subsequent commits. A fix is available in version 2.16.0_17.