Threats tagged 'brew-fdroidserver-cve-2026-78675'

GitPython versions from 0.7.0 up to but not including 2.4.5_5 contain a vulnerability where the SubmoduleConfigParser does not disable the merge_includes feature when parsing the .gitmodules file. This allows an attacker controlling the .gitmodules file to specify an [include] directive that references arbitrary local files. When the repository's submodules are enumerated, GitPython attempts to parse these included files as git config files. If the included file is not a valid git config, the parser raises an exception that leaks the first line of the included file in the error message. This results in local file content disclosure of the first line of any readable file on the victim's system.