Threats tagged 'brew-mistral-vibe-cve-2026-44244'

GitPython versions >=2.1.0 <2.9.2 and >=2.10.0 <2.18.0 contain a vulnerability in config_writer().set_value() that allows newline injection. This enables an attacker to inject a malicious core.hooksPath configuration, causing Git to execute attacker-controlled hooks during operations like commit, merge, or checkout. The flaw arises because set_value() does not validate or reject newline characters in values, and Git accepts indented [core] stanzas as valid configuration sections. This can lead to persistent repository config poisoning and remote code execution in multi-user or shared environments.