Threats tagged 'brew-legit-cve-2026-73619'

GitPython's Repo.archive() method uses a denylist to block unsafe git archive options that could lead to arbitrary command execution or file writes. However, the denylist is incomplete and omits the --add-file and --add-virtual-file options, which allow reading arbitrary files from the filesystem and injecting attacker-controlled content into archives. This flaw enables an attacker who can influence the options passed to Repo.archive() to read arbitrary files on the host with the privileges of the running process. The issue is fixed in GitPython version 1.2.0.post0_13.