Threats tagged 'brew-legit-cve-2026-69097'

GitPython versions up to 3.1.52 contain a vulnerability where attacker-controlled submodule names can inject arbitrary configuration directives into the .git/config file. This occurs because section names are insufficiently sanitized, allowing injection of directives like core.sshCommand, which can lead to remote code execution on the victim's next git operation. The vulnerability is fixed in version 1.2.0.post0_11.