Threats tagged 'brew-fdroidserver-cve-2026-110859'

GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method where an attacker-controlled branch name can be used to inject arbitrary git command arguments. This allows an attacker who can control the repository URL to cause the application to read arbitrary files accessible to the process, such as /etc/passwd, and return their contents through an exception. The flaw stems from incomplete sanitization of positional arguments in the checkout method, despite prior fixes addressing keyword argument injection. The vulnerability has a CVSS 3.1 score of 7.5 (High).