Threats tagged 'brew-cruft-cve-2026-87817'

GitPython version 3.1.59 contains a vulnerability (CVE-2026-87817) where the library incorrectly resolves the git directory path by testing candidate paths in an order that places the real .git directory last. This allows attacker-controlled repository content to impersonate the git directory, leading to arbitrary code execution when a victim performs a commit using GitPython's native index.commit() method. The vulnerability also allows reading files outside the repository and writing config files to attacker-chosen locations. The issue affects GitPython versions >=2.9.0 and <2.16.0_15 and has a CVSS score of 8.8 (high severity). A fix is available in version 2.16.0_15.