Threats tagged 'brew-cruft-cve-2026-67325'

GitPython versions from 2.9.0 up to but not including 2.16.0_11 contain a command injection vulnerability due to incomplete blocking of unsafe git options. The vulnerability arises because the fix for a prior CVE (CVE-2026-42215) only blocks exact matches of dangerous git options but does not account for git's acceptance of unambiguous long-option prefix abbreviations. This allows attackers controlling keyword argument keys to bypass the blocklist and execute arbitrary commands during clone, fetch, pull, or push operations.