Threats tagged 'brew-legit-cve-2026-76218'

GitPython's Repo.init method forwards keyword arguments directly to git init without guarding unsafe options like --template. This allows an attacker who can control the template argument and stage a malicious hooks directory to plant executable git hooks in the new repository. These hooks execute arbitrary code on the next git operation performed by the host process. The vulnerability affects GitPython versions prior to 1.2.0.post0_14 and requires attacker control over the template path and the ability to stage executable hooks. A fix is available in version 1.2.0.post0_14 that adds checks to block unsafe options.