Threats tagged 'brew-fdroidserver-cve-2026-78676'

GitPython versions before 2.4.5_5 have a vulnerability in the GitConfigParser component where multi-line git-config values are corrupted upon rewriting. This occurs because the parser decodes multi-line values correctly but the re-serialization logic writes them in a way that splits the value into separate config directives. An attacker can craft a dormant multi-line config value that, when rewritten by GitPython, injects new live git configuration directives such as core.hooksPath, enabling arbitrary code execution via git hooks.