Threats tagged 'brew-legit-cve-2026-76221'

GitPython versions prior to 1.2.0.post0_14 contain a vulnerability in the config-name validator that allows injection of arbitrary git configuration directives via crafted option names. The validator does not reject characters such as '=', '#', ';', '[', ']', or whitespace in option names, enabling attackers to forge directives like core.sshCommand or core.hooksPath. This can lead to remote code execution (RCE) when Git processes these injected directives during subsequent operations.