Threats tagged 'brew-legit-cve-2026-78679'

GitPython versions up to 1.2.0.post0_15 contain a vulnerability in the TagReference.create() method where a positional 'reference' argument can bypass the unsafe option guard for '--file'. This allows an attacker controlling the 'reference' parameter to cause an arbitrary local file read, with the file contents returned as the annotated tag message. The issue is an incomplete fix of a prior vulnerability and requires the embedding application to forward a user-controlled 'reference' value. A fix is available in version 1.2.0.post0_15.