Threats tagged 'brew-legit-cve-2026-114145'

A vulnerability in Legit's create_submodule function allows an attacker to plant an executable Git hook by specifying a submodule path of ".git/hooks". The path validation occurs only after the submodule is cloned, resulting in an attacker-controlled executable hook file that runs on subsequent Git operations. Versions 3.1.x silently allow this, while 3.2.0+ raise a ValueError after cloning but do not remove the planted hook, enabling code execution.