Threats tagged 'brew-mistral-vibe-cve-2026-110858'

GitPython's Remote.pull() method improperly handles the positional refspec argument, allowing an attacker to inject a --upload-pack option that bypasses the unsafe-option guard. This leads to arbitrary command execution with the privileges of the calling process when pulling from local-path or SSH transports. The vulnerability affects versions from 2.1.0 up to but not including 3.0.3 and is fixed in version 3.0.3.