Threats tagged 'brew-legit-cve-2026-78677'

GitPython versions prior to 1.2.0.post0_15 have a vulnerability in the clone_from() and clone() methods where the --separate-git-dir option is not blocked by the unsafe_git_clone_options denylist. This allows an attacker controlling input to specify an arbitrary filesystem path for the Git metadata directory during a clone operation, enabling creation of repository metadata outside the intended clone destination.