Threats tagged 'brew-fdroidserver-cve-2026-76219'

GitPython versions up to 3.1.57 contain a vulnerability in the IndexFile.from_tree, reset, and merge_tree methods where unguarded forwarding of treeish arguments to git read-tree allows an attacker to overwrite arbitrary files with a valid git-index blob. This occurs because the methods do not guard against unsafe options or use a '--' separator, enabling injection of the --index-output option to specify an arbitrary output path. The impact is arbitrary file overwrite at the privileges of the host process, potentially destroying important files. A fix is available in version 2.4.5_4.