Threats tagged 'brew-legit-cve-2026-67325'

GitPython versions from 0.1.0 up to but not including 1.2.0.post0_11 contain a command injection vulnerability (CVE-2026-67325) due to incomplete blocking of unsafe git options. The vulnerability arises because the fix for a previous issue (CVE-2026-42215) only blocks exact matches of dangerous git options but does not account for git's acceptance of unambiguous long-option prefix abbreviations. This allows attackers controlling keyword argument keys to bypass the blocklist and execute arbitrary commands during clone, fetch, pull, or push operations. A patch is available in version 1.2.0.post0_11.