Threats tagged 'brew-legit-cve-2026-76222'

GitPython versions prior to 1.2.0.post0_14 contain a vulnerability where the submodule name from a cloned repository's .gitmodules file is not validated. This allows an attacker controlling the repository to specify a submodule name with directory traversal sequences, causing GitPython to create and initialize a Git repository outside the intended working directory when submodules are initialized. This behavior differs from core Git, which blocks such attacks. The vulnerability requires the victim to clone the malicious repository using GitPython and run submodule initialization.