Threats tagged 'brew-legit-cve-2026-44244'

GitPython versions prior to 1.2.0.post0_9 contain a vulnerability in config_writer().set_value() where newline characters in values are not properly validated. This allows injection of a malicious core.hooksPath configuration, enabling remote code execution via Git hooks. The flaw arises because GitPython converts embedded newlines into indented continuation lines, which Git still interprets as valid section headers, activating attacker-controlled hooks. This can lead to persistent repository config poisoning, especially in multi-user or hosted environments where untrusted input is passed to set_value().