Threats tagged 'brew-fdroidserver-cve-2026-73624'

GitPython's Diffable.diff() method improperly forwards user-supplied arguments to git diff commands without validating unsafe options. This allows an attacker to inject the '--output' argument, causing git to overwrite arbitrary files with diff content at the process privilege level. The vulnerability affects versions up to and including 3.1.53. A fix is available that adds validation to prevent unsafe options or changes argument ordering to block option injection.